topic Re: problem about shadow passwords in Operating System - HP-UX

problem about shadow passwords

lin.chen — Wed, 15 Nov 2006 11:13:06 GMT

Could you tell me what is shadow password?
Does it has any difference with /etc/passwd?
thanks!

Re: problem about shadow passwords

Romanek — Wed, 15 Nov 2006 11:20:54 GMT

Shadow password takes your password from /etc/password and stores it in another location, usually /etc/shadow. This folder usually has stronger permissions so not everyone can view it. The problem is hackers can run crack utilities on /etc/password to obtain your password. If youâ re looking for greater security you may want to consider running your server in trusted mode. Please see docs bellow

Trusted:
http://docs.hp.com/en/B2355-90121/ch01s04.html

Shadow:
http://docs.hp.com/en/5187-0701/ch08s10.html

Re: problem about shadow passwords

A. Clay Stephenson — Wed, 15 Nov 2006 11:21:52 GMT

Unix does not store encrypted passwords but rather password hashes. This means that then cannot be decrypted because the hashing process is not reversible,. However, a guessing attack can succeed. You passwd your guess through the normal crypt() function and if the output matches the stored password hash, you guessed correctly. In a traditional password file which is readable by everyone, the password hash is simply a field in that file -- so anyone could apply a password guessing attack and have a value that could be compared. In a shadowed system, the password hash is moved out to another file that is only readable by root and the original hash field is replaced with '*'.

Re: problem about shadow passwords

Romanek — Wed, 15 Nov 2006 11:21:58 GMT

sorry that should of been /etc/passwd.

Re: problem about shadow passwords

Pete Randall — Wed, 15 Nov 2006 11:22:46 GMT

More information available here:

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=ShadowPassword

Pete