In this lesson, you will learn how to decode the structure of the /etc/passwd and /etc/shadow files to understand how Linux manages user identities and password security.
The /etc/passwd File: User Identity
The /etc/passwd file is a world-readable database that stores basic user information. Every line represents a single user, divided into seven fields separated by colons (:):
username:x:UID:GID:comment:home_directory:login_shell
- username: The login name.
- x: Historically the password field, now a placeholder indicating the actual password is in
/etc/shadow. - UID/GID: The unique User and Group IDs.
- comment: Usually the user's full name.
- home_directory: The path to the user's folder.
- login_shell: The command interpreter (like
/bin/bash).
The /etc/shadow File: Secret Security
Because /etc/passwd is readable by everyone, sensitive password data is moved to /etc/shadow, which is only readable by the root user. Each entry contains nine fields:
username:password_hash:last_change:min_age:max_age:warn:inactive:expire:reserved
- password_hash: The encrypted version of the password. It includes the algorithm ID (e.g.,
$6$for SHA-512) and a salt to prevent rainbow table attacks. - last_change: The number of days since the last password change (counting from Jan 1, 1970).
- min_age: The minimum days required between password changes.
- max_age: The maximum days a password is valid before it must be changed—this is a primary tool for account aging policies.
- warn: Days before the password expires that the user receives a warning.
- inactive: Days after password expiration that the account is disabled.
- expire: An absolute date (in days since epoch) when the account will be locked regardless of password status.
By separating identity from secret hashing, Linux ensures that even if a regular user can see who is on the system, they cannot attempt to crack the encrypted passwords stored in /etc/shadow.
Key Takeaway: The /etc/passwd file defines user identity and environment, while the /etc/shadow file enforces secure password hashing and account aging policies by restricting access to sensitive metadata.