03-05-2002
Yes, you can stop using the /etc/shadow file but it is NOT advisable - it was created because folks once found that they could grab the /etc/passwd file and run password crackers against it. Harder to do with /etc/shadow IF the permissions are set correctly. You can't set /etc/passwd to the same permissions since then no one could read it on login.
Check the man page for pwconv. I have not seen pwunconv on Solaris. To remove the use of /etc/shadow, you would have to do it manually.
10 More Discussions You Might Find Interesting
1. Programming
I'm writing a 'C' program on various systems (HP-UX, Solaris, AIX, NCR) which needs to interact with a user's password. Some of my systems are using the shadow password and some are not. It is possible for some of my systems to have /etc/shadow, even though the box is not using the file (I know,... (4 Replies)
Discussion started by: chrisc@nwark.ne
4 Replies
2. Solaris
my etc/shadow file showing *LK* for a particular user.. can u tell me under which circumstances a user is locked (5 Replies)
Discussion started by: vikashtulsiyan
5 Replies
3. UNIX for Advanced & Expert Users
Does anyone know what "!!" represents in the password field of the /etc/shadow file? :confused: (6 Replies)
Discussion started by: avcert1998
6 Replies
4. UNIX for Dummies Questions & Answers
Hi,
I am new to shell programming and trying to write a command that would show the etc/shadow file but without the hashes. So, something like this:
root: <HASH PASSWORD FOUND BUT OBFUSCATED>
daemon: NP
bin: NP
sys: NP
If there is a... (2 Replies)
Discussion started by: hellomms
2 Replies
5. UNIX for Dummies Questions & Answers
In /etc/shadow ..we have all the user entries ..?
Like when ever an user is created a corresponding entry is created in /etc/shadow...? (2 Replies)
Discussion started by: rachna
2 Replies
6. Shell Programming and Scripting
Hi,
In shadow file
smithj:Ep6mckrOLChF.:10063:0:99999:7:::
3rd Field 10063 indicates the number of days (since January 1, 1970) since the password was last changed.
I want to get the result with script the date on which the password was last changed in YYYY-MM-DD format.
can... (8 Replies)
Discussion started by: pinnacle
8 Replies
7. UNIX for Dummies Questions & Answers
I notice there are '*'s and '!!'s in my /etc/shadow file.
And I know these are for preventing login. But what are the differences among '*', '!' and '!!' ?
THX!
mail:*:14789:0:99999:7:::
uucp:*:14789:0:99999:7:::
...
dbus:!!:14919::::::
rpc:!!:14919:0:99999:7:::
...... (4 Replies)
Discussion started by: vistastar
4 Replies
8. UNIX for Dummies Questions & Answers
Dear all,
I need all of you to clarify about file permission and SUID, SGID as below:
Command:
$ ls -la /etc/passwd
-r--r--r-- 1 root root 1914 2011-04-15 11:22 /etc/passwd
# I've changed permission of this file
$ ls -la /etc/shadow
-r--r----- 1 root shadow 1397 2011-08-01 15:53... (3 Replies)
Discussion started by: all4cfa
3 Replies
9. UNIX for Dummies Questions & Answers
As a part of linux hardening
In shadow file all Application accounts which are not locked must contain only an asterisk “*” in the Passwd field.
But how would i do it by using command?
Is there any way other than modifying shadow file to accomplish this task? (3 Replies)
Discussion started by: pinga123
3 Replies
10. UNIX for Advanced & Expert Users
Hi,
I wanna see the content of the file /etc/shadow..
But i don't have the permission and also the root permission. Still is it possible to view it??? Any tricks?? (5 Replies)
Discussion started by: Adhi
5 Replies
LEARN ABOUT LINUX
pwunconv
PWCONV(8) System Management Commands PWCONV(8)
NAME
pwconv, pwunconv, grpconv, grpunconv - convert to and from shadow passwords and groups
SYNOPSIS
pwconv
pwunconv
grpconv
grpunconv
DESCRIPTION
The pwconv command creates shadow from passwd and an optionally existing shadow.
The pwunconv command creates passwd from passwd and shadow and then removes shadow.
The grpconv command creates gshadow from group and an optionally existing gshadow.
The grpunconv command creates group from group and gshadow and then removes gshadow.
These four programs all operate on the normal and shadow password and group files: /etc/passwd, /etc/group, /etc/shadow, and /etc/gshadow.
Each program acquires the necessary locks before conversion. pwconv and grpconv are similar. First, entries in the shadowed file which
don't exist in the main file are removed. Then, shadowed entries which don't have `x' as the password in the main file are updated. Any
missing shadowed entries are added. Finally, passwords in the main file are replaced with `x'. These programs can be used for initial
conversion as well to update the shadowed file if the main file is edited by hand.
pwconv will use the values of PASS_MIN_DAYS, PASS_MAX_DAYS, and PASS_WARN_AGE from /etc/login.defs when adding new entries to /etc/shadow.
Likewise pwunconv and grpunconv are similar. Passwords in the main file are updated from the shadowed file. Entries which exist in the main
file but not in the shadowed file are left alone. Finally, the shadowed file is removed. Some password aging information is lost by
pwunconv. It will convert what it can.
BUGS
Errors in the password or group files (such as invalid or duplicate entries) may cause these programs to loop forever or fail in other
strange ways. Please run pwck and grpck to correct any such errors before converting to or from shadow passwords or groups.
CONFIGURATION
The following configuration variable in /etc/login.defs changes the behavior of grpconv and grpunconv:
MAX_MEMBERS_PER_GROUP (number)
Maximum members per group entry. When the maximum is reached, a new group entry (line) is started in /etc/group (with the same name,
same password, and same GID).
The default value is 0, meaning that there are no limits in the number of members in a group.
This feature (split group) permits to limit the length of lines in the group file. This is useful to make sure that lines for NIS
groups are not larger than 1024 characters.
If you need to enforce such limit, you can use 25.
Note: split groups may not be supported by all tools (even in the Shadow toolsuite). You should not use this variable unless you really
need it.
The following configuration variables in /etc/login.defs change the behavior of pwconv:
PASS_MAX_DAYS (number)
The maximum number of days a password may be used. If the password is older than this, a password change will be forced. If not
specified, -1 will be assumed (which disables the restriction).
PASS_MIN_DAYS (number)
The minimum number of days allowed between password changes. Any password changes attempted sooner than this will be rejected. If not
specified, -1 will be assumed (which disables the restriction).
PASS_WARN_AGE (number)
The number of days warning given before a password expires. A zero means warning is given only upon the day of expiration, a negative
value means no warning is given. If not specified, no warning will be provided.
FILES
/etc/login.defs
Shadow password suite configuration.
SEE ALSO
grpck(8), login.defs(5), pwck(8).
System Management Commands 06/24/2011 PWCONV(8)