Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Well we all know that it holds passwords. But cat-ing it gives out nothing. Not even encrypted gibberish. So how exactly is a password stored in this? Is this like a device file or something?

share|improve this question

migrated from stackoverflow.com May 20 '10 at 13:09

This question came from our site for professional and enthusiast programmers.

2  
Read here: en.wikipedia.org/wiki/Shadow_password –  0xA3 May 20 '10 at 13:08
    
Catting it seems to give me a whole bunch of output. –  user35583 May 20 '10 at 13:08
    
Belongs to superuser or serverfault! –  mosg May 20 '10 at 13:09

4 Answers 4

For a little historical background:

Long ago, there was the /etc/passwd file that held all sorts of information about the user, including not only an encrypted version of the user's password, but things like the user's home directory, groups, default shell, and name. This was handy, and lots of system utilities used the /etc/passwd file for various purposes. The practice of storing only an encrypted version of the password was a great advance over storing the real password in a (hopefully) protected file, and the encryption algorithm could be tuned to be fast enough to be practical but slow enough to make brute force cracking impractical with contemporary hardware.

Back then, Unix was usually used in research and academic environments, and security wasn't a big deal (which turned out to be a bad idea in 1988, with the Robert Morris worm). As it was used in more hostile environments, and as computer power improved, it was less and less practical to rely on encryption alone, and so it became desirable to move the passwords to a less accessible file.

Now, there were very large numbers of programs of varying sorts that used /etc/passwd for the information buried there, and it was not practical to go through and change them all. Therefore, the passwords were put into a new file (often /etc/shadow), which was locked down as much as possible to all accounts except root, and all the other information was left behind.

share|improve this answer
    
Moreover, some of the information in /etc/passwd must be publicly readable: notable the connection between UID and username is established in that file. –  dmckee May 20 '10 at 14:34

See here.

share|improve this answer

On linux the passwords are stored in /etc/shadow and on BSD systems they are stored in /etc/master.passwd.

share|improve this answer

Storing passwords in /etc/password is sooo waay in the past. /etc/passwd is used for storing simple user information like UID, username, real name, etc. It also has a field that tells you if the account has a password, and if it does, you should look in /etc/passwd

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.