UNIX for Advanced & Expert Users

hi, all
I just started on new box where I have to diff passwd working perfectly on the very same account/user. I see that shadow was added recently (I'm not a root in there), I see 'x' in passwd. Not sure how it should work, should I change old passwd for one defined in shadow? Or it's fine to have 2 of them, or it's a bug?

It's RHat 5 Ent Linux.


Tx
T

you don't need to edit /etc/shadow directly. The passwords are stored here for security reasons as /etc/passwd needs to be world readable.

/etc/passwd used to contain actual hashed passwords -- readable by any user on the system! At the time, crypt() was (intentionally) too slow for a brute-force search(feeding every dictionary word times every possible salt into crypt() until you get the same hash) to be practical, and this worked for a while, but eventually CPU's got fast enough that brute-forcing a hash became possible.

So they moved the password hashes into /etc/shadow, which nobody but the login system can read. They kept the rest of the data in /etc/passwd.

Modern systems also often use better hashing algorithms than crypt().

Thansk,
but do we have to have 2 diff password for system ? Now I can login using both of them.

Tx
T

No. Password hashes aren't stored in /etc/passwd at all anymore, just an 'x' meaning 'this user has a password in /etc/shadow', or perhaps some other string meaning 'this user is disabled'. Nothing else is valid.

YEs, so it's some kind of bug. Now I can use 2 passwords for the same account.

T

How long are the passwords? Many systems ignore everything after the first eight letters(another legacy of UNIX crypt).