shadow password file

When the user logs on, the password entered by the user during the log on process is run through the same key derivation function and the resulting hashed version is compared with the saved version. If the hashes are identical, the entered password is considered to be correct, and the user is authenticated. In theory, it is possible for two different passwords to produce the same hash . However, cryptographic hash functions are designed in such a way that finding any password that produces the same hash is very difficult and practically infeasible, so if the produced hash matches the stored one, the user can be authenticated. [[1]]( In many operating systems, this file is just one of many possible back-ends for the more general passwd name service "Passwd (database)") . The file's name originates from one of its initial functions as it contained the data used to verify passwords of user accounts. However, on modern Unix systems the security-sensitive password information is instead often stored in a different file using shadow passwords, or other database implementations. The /etc/passwd file is a text file with one record per line "Line (text file)") , each describing a user account "User (computing)") . Each record consists of seven fields separated by colons "Colon (punctuation)") . The ordering of the records within the file is generally unimportant. 3. 1001 : user identifier "User identifier (Unix)") number, used by the operating system for internal purposes. It must be unique as it identifies users uniquely. 4. 1000 : group identifier "Group identifier (Unix)") number, which identifies the primary group of the user; all files that are created by this user may initially be accessible to this group. 5. John Doe,Room 1007... : Gecos field , commentary that describes the person or account. Typically, this is a set of comma-separated values including the user's full name and contact details.[[4]]( Systems administrators can reduce the likelihood of brute-force attacks by making the list of hashed passwords unreadable by unprivileged users. The obvious way to do this is to make the passwd database itself readable only by the root user. However, this would restrict access to other data in the file such as username-to-userid mappings, which would break many existing utilities and provisions. One solution is a "shadow" password file to hold the password hashes separate from the other data in the world-readable passwd file. For local files, this is usually /etc/shadow on Linux and Unix systems, or /etc/master.passwd on BSD systems; each is readable only by root . (Root access to the data is considered acceptable since on systems with the traditional "all-powerful root" security model, the root user would be able to obtain the information in other ways in any case). Virtually all recent Unix-like operating systems use shadowed passwords. The shadow password file does not entirely solve the problem of attacker access to hashed passwords, as some network authentication schemes operate by transmitting the hashed password over the network (sometimes in cleartext , e.g., Telnet [[6]]( ), making it vulnerable to interception. Copies of system data, such as system backups written to tape or optical media, can also become a means for illicitly obtaining hashed passwords. In addition, the functions used by legitimate password-checking programs need to be written in such a way that malicious programs cannot make rapid authentication checks. The format of the shadow file is simple, and basically identical to that of the password file, to wit, one line per user, ordered fields on each line, and fields separated by colons. Many [quantify ] systems require the order of user lines in the shadow file be identical to the order of the corresponding users in the password file. Prior to password shadowing, a Unix user's hashed password was stored in the second field of their record in the /etc/passwd file (within the seven-field format as outl