/etc/passwd and /etc/shadow in Linux CLI - Step-by-Step Execution

Concept Flow - /etc/passwd and /etc/shadow

Read /etc/passwd

↓

Parse user info: username, UID, GID, home, shell

↓

Check password field in /etc/passwd

↓

Read /etc/shadow for encrypted password

↓

Verify password or manage user authentication

↓

Use info for login or system tasks

↓

End

The system reads /etc/passwd for user info, then checks /etc/shadow for secure password data to authenticate users.

Execution Sample

Linux CLI

cat /etc/passwd
cat /etc/shadow

Shows the contents of /etc/passwd and /etc/shadow files to see user info and encrypted passwords.

Execution Table

Step	Command	Action	Output Example	Notes
1	cat /etc/passwd	Read user account info	root:x:0:0:root:/root:/bin/bash user1:x:1000:1000::/home/user1:/bin/bash	Password field is 'x' meaning password is in /etc/shadow
2	cat /etc/shadow	Read encrypted passwords	root:$6$abc123$encryptedhash...:18295:0:99999:7::: user1:$6$def456$encryptedhash...:18295:0:99999:7:::	Passwords are hashed and secured
3	Check password field in /etc/passwd	Find 'x' or '*'	'x' found	Indicates password stored in /etc/shadow
4	Use info for login	Authenticate user by comparing password hash	Success or failure	System uses /etc/shadow hash to verify password
5	End	No more steps	N/A	Process complete

💡 Finished reading user info and password hashes for authentication

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
passwd_content		root:x:0:0:root:/root:/bin/bash user1:x:1000:1000::/home/user1:/bin/bash	Same	Same	Same
shadow_content			root:$6$abc123$encryptedhash... user1:$6$def456$encryptedhash...	Same	Same
password_field				'x'	'x' means password in shadow file

Key Moments - 3 Insights

Why does /etc/passwd show 'x' in the password field instead of the actual password?

Because the actual encrypted passwords are stored securely in /etc/shadow, not in /etc/passwd. See execution_table step 3 where 'x' indicates this.

What is the difference between /etc/passwd and /etc/shadow?

/etc/passwd contains user info like username and home directory, while /etc/shadow stores encrypted passwords securely. This separation improves security (see execution_table steps 1 and 2).

Can a normal user read /etc/shadow?

No, /etc/shadow has restricted permissions to protect password hashes. Only root or privileged processes can read it (implied in execution_table step 2).

Visual Quiz - 3 Questions

Look at the execution table, what does the 'x' in the password field of /etc/passwd mean at step 3?

A Password is stored in /etc/shadow

B Password is empty

C Password is stored in /etc/passwd

D User account is disabled

💡 Hint

Refer to execution_table row 3 under 'Notes' explaining the meaning of 'x'

At which step do we see the encrypted password hashes?

A Step 1

B Step 3

C Step 2

D Step 4

💡 Hint

Check execution_table row 2 under 'Output Example' for encrypted hashes

If /etc/shadow is unreadable, what impact does it have on user authentication?

A Users can still log in with passwords

B System cannot verify passwords, login fails

C Passwords are read from /etc/passwd instead

D User accounts are deleted

💡 Hint

Refer to execution_table step 4 where password verification uses /etc/shadow

Concept Snapshot

/etc/passwd stores user info like username, UID, home directory.
Password field shows 'x' or '*' if password is in /etc/shadow.
/etc/shadow stores encrypted passwords securely with restricted access.
System reads /etc/passwd first, then /etc/shadow to authenticate users.
This separation protects password security on Linux systems.

Full Transcript

The /etc/passwd file contains basic user account information such as username, user ID, group ID, home directory, and default shell. However, it does not store actual passwords for security reasons. Instead, the password field in /etc/passwd usually contains an 'x' or '*', indicating that the encrypted password is stored in the /etc/shadow file. The /etc/shadow file holds the hashed passwords and has restricted permissions to protect this sensitive data. When a user logs in, the system reads /etc/passwd to find the user details, then reads /etc/shadow to verify the password by comparing the entered password's hash with the stored hash. This two-file system improves security by limiting access to password hashes. Normal users cannot read /etc/shadow, only privileged users or processes can. This separation is essential for safe user authentication on Linux systems.

Practice

1. What is the primary purpose of the /etc/passwd file in Linux?

easy

A. To store encrypted user passwords securely

B. To configure network settings

C. To store user account information accessible to all users

D. To log system errors

Solution

1. Step 1: Understand the role of /etc/passwd

   The /etc/passwd file contains user account details like username, user ID, group ID, home directory, and shell. It is readable by all users.

2. Step 2: Differentiate from /etc/shadow

   The encrypted passwords are stored separately in /etc/shadow for security, not in /etc/passwd.

3. Final Answer:

   To store user account information accessible to all users -> Option C

4. Quick Check:

   /etc/passwd = user info file [OK]

Hint: Remember: passwd = public user info, shadow = private passwords [OK]

Common Mistakes:

• Confusing /etc/passwd with /etc/shadow
• Thinking passwords are stored in /etc/passwd
• Assuming /etc/passwd stores system logs

2. Which of the following lines correctly shows the format of a typical /etc/shadow entry?

easy

A. username:x:1000:1000:User Name:/home/user:/bin/bash

B. username:$6$randomsalt$encryptedpassword:18000:0:99999:7:::

C. username:password:1000:1000:User Name:/home/user:/bin/bash

D. username:encryptedpassword:1000:1000:User Name:/home/user:/bin/bash

Solution

1. Step 1: Identify /etc/shadow format

   The /etc/shadow file stores encrypted passwords and related info. The password field looks like $6$randomsalt$encryptedpassword for SHA-512 encryption.

2. Step 2: Compare options

   The line username:$6$randomsalt$encryptedpassword:18000:0:99999:7::: matches the shadow file format with encrypted password (indicated by $6$) and password aging fields separated by colons. The other options resemble /etc/passwd format or have incorrect password fields.

3. Final Answer:

   username:$6$randomsalt$encryptedpassword:18000:0:99999:7::: -> Option B

4. Quick Check:

   /etc/shadow entries have encrypted passwords with $ signs [OK]

Hint: Look for $ signs and many colon-separated fields in shadow entries [OK]

Common Mistakes:

• Confusing /etc/passwd format with /etc/shadow
• Expecting plain text passwords in /etc/shadow
• Missing fields after encrypted password

3. Given the following command:

grep '^root:' /etc/passwd | cut -d':' -f1,3,7

What will be the output format?

medium

A. root:/bin/bash

B. root:x:0:0:root:/root:/bin/bash

C. root:0:0

D. root:0:/bin/bash

Solution

1. Step 1: Understand the command parts

   grep '^root:' /etc/passwd finds the line starting with 'root:'. cut -d':' -f1,3,7 extracts fields 1 (username), 3 (UID), and 7 (shell) separated by colons.

2. Step 2: Identify root line fields

   Typical root line: root:x:0:0:root:/root:/bin/bash. Fields: 1=root, 2=x, 3=0, 4=0, 5=root, 6=/root, 7=/bin/bash.

3. Step 3: Extract fields 1,3,7

   Fields 1=root, 3=0, 7=/bin/bash. Joined by colons: root:0:/bin/bash.

4. Final Answer:

   root:0:/bin/bash -> Option D

5. Quick Check:

   Fields 1,3,7 from /etc/passwd line = root:0:/bin/bash [OK]

Hint: Count fields carefully; cut -f1,3,7 picks username, UID, shell [OK]

Common Mistakes:

• Mixing up field numbers in cut command
• Expecting full /etc/passwd line output
• Confusing shadow file format with passwd

4. You run this command to check password expiry info:

sudo chage -l username

But it shows an error: chage: user 'username' does not exist. What is the most likely cause?

medium

A. The username is missing in /etc/passwd

B. The /etc/shadow file is empty

C. The chage command is not installed

D. The user has no password set

Solution

1. Step 1: Understand chage user check

   The chage command checks user password expiry info by looking up the username in /etc/passwd.

2. Step 2: Analyze error cause

   Error 'user does not exist' means the username is not found in /etc/passwd. If the user was missing there, chage cannot proceed.

3. Final Answer:

   The username is missing in /etc/passwd -> Option A

4. Quick Check:

   User must exist in /etc/passwd for chage to work [OK]

Hint: Check /etc/passwd for username before using chage [OK]

Common Mistakes:

• Assuming /etc/shadow emptiness causes this error
• Thinking chage command missing causes user error
• Believing no password set triggers 'user does not exist'

5. You want to write a script that lists all users who have a valid login shell (not /usr/sbin/nologin or /bin/false) by reading /etc/passwd. Which command snippet correctly filters these users?

hard

A. awk -F':' '$7 != "/usr/sbin/nologin" && $7 != "/bin/false" {print $1}' /etc/passwd

B. grep -v '/usr/sbin/nologin' /etc/shadow | cut -d':' -f1

C. cat /etc/passwd | grep '/bin/bash' | awk '{print $1}'

D. sed '/nologin/d' /etc/passwd | cut -d':' -f7

Solution

1. Step 1: Identify shell field in /etc/passwd

   The 7th field in /etc/passwd is the user's login shell. We want to exclude /usr/sbin/nologin and /bin/false.

2. Step 2: Analyze each option

   awk -F':' '$7 != "/usr/sbin/nologin" && $7 != "/bin/false" {print $1}' /etc/passwd uses awk with field separator ':' and filters out unwanted shells, printing usernames (field 1). grep -v '/usr/sbin/nologin' /etc/shadow | cut -d':' -f1 wrongly reads /etc/shadow and uses grep -v incorrectly. cat /etc/passwd | grep '/bin/bash' | awk '{print $1}' filters only /bin/bash but misses other valid shells. sed '/nologin/d' /etc/passwd | cut -d':' -f7 deletes lines with 'nologin' but then prints shell field, not usernames.

3. Final Answer:

   awk -F':' '$7 != "/usr/sbin/nologin" && $7 != "/bin/false" {print $1}' /etc/passwd -> Option A

4. Quick Check:

   Use awk on /etc/passwd to filter shell field and print usernames [OK]

Hint: Use awk with FS=':' and check field 7 for valid shells [OK]

Common Mistakes:

• Using /etc/shadow instead of /etc/passwd for shell info
• Printing wrong fields (shell instead of username)
• Using grep without proper field filtering