Where are the passwords of the users located in Linux?

Posted on in Categories , , last updated August 28, 2006

The encrypted passwords and other information such as password expiry information (the password aging information) are stored in /etc/shadow file. However, normal user cannot access the /etc/shadow file directly. For example, try out following cat command:

$ cat /etc/shadow

Output:

cat: /etc/shadow: Permission denied

You can only access this file via few commands such as passwd. Login as root user and execute cat command on /etc/shadow file:

$ su –

Password:

# cat /etc/shadow

Output:

root: $1$s83Ugoff$EDT83WAAFpCQHWDp07E9Ux:0:99999:7:::
daemon:*:13031:0:99999:7:::
bin:*:13031:0:99999:7:::

Each entry in /etc/shadow is divided into following fields:

  • Login name
  • Encrypted password
  • Days since Jan 1, 1970 that password was last changed
  • Days before password may be changed
  • Days after which password must be changed
  • Days before password is to expire that user is warned
  • Days after password expires that account is disabled
  • Days since Jan 1, 1970 that account is disabled

Please note that FreeBSD uses /etc/master.shadow file.

Posted by: Vivek Gite

The author is the creator of nixCraft and a seasoned sysadmin and a trainer for the Linux operating system/Unix shell scripting. He has worked with global clients and in various industries, including IT, education, defense and space research, and the nonprofit sector. Follow him on Twitter, Facebook, Google+.

Leave a Comment