/etc/shadow File Explained - Linux Tutorial
/etc/shadow File Explained is a free tutorial by Ted LeRoy from Linux course
Link to this course(Special Discount):
https://www.udemy.com/course/ubuntu-s...
This is the best Linux Course
Course summary:
You will learn what Linux is
Installing Linux
Working at the command line and why the Command Line Interface is so simple yet powerful
Configuring and securing remote access with SSH
Securing your server, ufw, apt update and upgrade
Stopping bad guys with Fail2ban
Installing and securing nginx web server
Managing users and groups
How to use the Linux file system
English [Auto]
So last lesson we looked at the Etsy password file. Now we're going to look at its partner. That's a shadow file as I mentioned in the last lesson. Passwords used to be stored in the second field in NC password file but that's insecure because everyone has to be able to read that's a password file. Now passwords are stored in the artsy shadow file. So let's take a look. So you can see similar fields to the Etsy password file they're still separated by colons but some entries have these long strings in them that long string is the encrypted password. And some other information which will go over in a second so I had a at a high level it has user name password last password change date looks that number doesn't look like a date because it isn't it's the number of days since January 1st 1970. It's a very strange system. I don't know what the reasoning was in order to get this number you have to know the current date or what the system thinks the current date is. So I don't know why you couldn't just I don't know why why that's like that but that's the way they chose to do it. So the next field is the minimum password age so some users do if they have to change their password periodically is just cycle through until they can get back to their old password so let's say your computer remembers the last five passwords you use if you go through that and put it in a new password six times you're back to your original you could be back to your original. So this value would make you have to wait. So if you put a one in here a person would have to wait one day to try another password so that they would have to go six days to get back to their original password. And most people don't don't go through that headache. So this is just kind of to keep people from cycling through like that maximum password age ninety nine thousand nine hundred and ninety nine here that's about two hundred seventy four years. So in effect your password never expires number of days before the password expires to warn the user. So seven days before two hundred and seventy four years this would warn you that your password is about to expire. If you have a reasonable value in here instead of nine ninety nine thousand nine hundred ninety nine if you have 90 it would warn seven days prior to expiration the next field is often blank but if it's filled in it would indicate the number of days after the password expires until the account is disabled and then the last field could be if it's in use an expiration and that is again days from January 1st 1970. So again I don't know why they do it that way. If you're using one of the programs to do this like user mod you don't have to worry about that January 1st 1970 thing. So let's go back and look at the actual encrypted password field. This whole field this isn't just the password it's actually a few items that tell you about the password as well so the first it's delimited by dollar signs. So the first Dollar Sign Dollar Sign six says we're using SHA 512 hashing algorithm SHA 512 is is pretty strong it's the lowest you probably want to use on a modern system and it's one of several possible algorithms. You can have dollar sign one would be empty five I definitely wouldn't recommend that dollar sign to a blowfish Teller sign to y blowfish with the correct handling of a big characters and dollar sign for which is SHA 256. These are all spelled out in the downloadable materials for this lesson so the first part hopefully you always see at least dollar sign six here. I don't think there's anything higher that would be in there at this time but going forward who knows the next field from this dollar sign to this dollar sign is a salt for the hashing algorithm that generated your password your encrypted password this randomly generated value is plugged into the software that actually generates the password this way. If two users have the exact same password they'll still have different hashes because these are randomly generated and that will result in a different password a different encrypted password even though the passwords may be identical. You'll also notice that many files do