Linux Shadow File Explained: Securing User Passwords

The /etc/shadow file plays a critical role in Linux security by separating sensitive authentication data from general user information to prevent unauthorized access and offline password cracking. Historically, password hashes were stored in the globally readable /etc/passwd file, leaving systems vulnerable to brute-force attacks by unprivileged users. This article explains the purpose of the shadow file, how its restrictive permissions protect cryptographic hashes, and the essential password aging policies it enforces.

The Problem with /etc/passwd

In early Unix and Linux implementations, all user information—including user IDs, group IDs, home directories, default shells, and encrypted password hashes—was stored in the /etc/passwd file. Many system utilities and software programs (such as ls and ps) need to read this file to map numeric user IDs to human-readable usernames. Consequently, /etc/passwd required world-readable permissions (rw-r--r-- or 644).

Because anyone with local access could read the file, malicious users could easily copy the password hashes and run offline dictionary or brute-force attacks without detection.

Restrictive Permissions and Privilege Separation

The shadow file (/etc/shadow) was introduced to solve this vulnerability through privilege separation. Non-sensitive user account metadata remains in the world-readable /etc/passwd file, but the actual password hashes are moved to /etc/shadow.

The security mechanism of the shadow file relies on strict file permissions:

Because standard users lack read access to /etc/shadow, they cannot extract password hashes. Only privileged system processes running with superuser permissions (or setuid binaries such as /usr/bin/passwd) can read the file to authenticate users.

Managing Password Aging and Account Policies

Beyond securing password hashes, /etc/shadow controls password aging, which is critical for enforcing enterprise password policies. Each entry contains nine colon-separated fields:

  1. Username: The account login name.
  2. Encrypted Password: The password hash, preceded by an identifier indicating the hashing algorithm used (such as SHA-512 or yescrypt).
  3. Last Password Change: The date of the last password change, expressed in days since the Unix epoch (January 1, 1970).
  4. Minimum Password Age: The minimum number of days required before a user is allowed to change their password again.
  5. Maximum Password Age: The maximum validity period for a password, after which the user must change it.
  6. Warning Period: The number of days prior to password expiration that a warning is issued to the user.
  7. Inactivity Period: The number of days after a password expires before the account is automatically disabled.
  8. Expiration Date: The absolute date on which the account is disabled, expressed in days since the Unix epoch.
  9. Reserved Field: Reserved for future use.

Summary

The purpose of the shadow file is to mitigate the risk of password extraction and facilitate centralized account lifecycle management. By restricting access to cryptographic hashes and managing password expiration parameters, the shadow suite remains one of the fundamental security baselines of the modern Linux operating system.