passwd is a tool on most Unix and Unix-like operating systems used to
change a user's password. The password entered by the user is run through a key
derivation function to create a hashed version of the new password, which is
saved. Only the hashed version is stored; the entered password is not
saved for security reasons. When the user logs on, the password
entered by the user during the log on process is run through the same key
derivation function and the resulting hashed version is compared with the
saved version. If the hashes are identical, the entered password are
considered to be identical, and so the user is authenticated. In theory, it is
possible to occur that two different passwords produce the same hash.
However, cryptographic hash functions are designed in such a way that finding
any password that produces the given hash is very difficult and practically
unfeasible, so if the produced hash matches the stored one, the user can be
authenticated. The passwd command may be used to change
passwords for local accounts, and on most systems, can also be used to change
passwords managed in a distributed authentication mechanism such as NIS,
Kerberos, or LDAP. Password file
The passwd file is a text-based database of information about users that may log
in to the system or other operating system user identities that own running
processes. In many operating systems this file is
just one of many possible back-ends for the more general passwd name service.
The file's name originates from one of its initial functions as it contained
the data used to verify passwords of user accounts. However, on modern Unix
systems the security-sensitive password information is instead often stored in a
different file using shadow passwords, or other database implementations.
The passwd file typically has file system permissions that allow it to be
readable by all users of the system, although it may only be modified by the
superuser or by using a few special purpose privileged commands.
The passwd file is a text file with one record per line, each describing a user
account. Each record consists of seven fields separated by colons. The ordering
of the records within the file is generally unimportant.
An example record may be: jsmith:x:1001:1000:Joe Smith,Room
4)555-8910,(234)555-0044,email:jsmith:sh The fields, in order from left to right,
are: User name: the string a user would type
in when logging into the operating system: the logname. Must be unique
across users listed in the file. Information used to validate a user's
password; in most modern uses, this field is usually set to "x" with the
actual password information being stored in a separate shadow password file.
Setting this field to an asterisk is a common way to disable direct logins to
an account while still preserving its name. Another possible value is "*NP*"
which indicates to use an NIS server to obtain the password.
user identifier number, used by the operating system for internal purposes.
It need not be unique. group identifier number, which
identifies the primary group of the user; all files that are created by this
user may initially be accessible to this group.
Gecos field, commentary that describes the person or account. Typically, this
is a set of comma-separated values including the user's full name and
contact details. Path to the user's home directory.
Program that is started every time the user logs into the system. For an
interactive user, this is usually one of the system's command line interpreters.
Shadow file shadow is used to increase the security
level of passwords by restricting all but highly privileged users' access to
hashed password data. Typically, that data is kept in files owned by and
accessible only by the super user. Systems administrators can reduce the
likelihood of brute force attacks by making the list of hashed passwords
unreadable by unprivileged users. The obvious way to do this is to make the
passwd database itself readable only by the root user. However, this would
restrict access to other data in the file such as username-to-userid
mappings, which would break many existing utilities and provisions. One
solution is a "shadow" password file to hold the password hashes separate from
the other data in the world-readable passwd file. For local files, this is
usually shadow on Linux and Unix systems, or master.passwd on BSD
systems; each is readable only by root.. Virtually all recent Unix-like operating
systems use shadowed passwords. The shadow password file does not
entirely solve the problem of attacker access to hashed passwords, as some
network authentication schemes operate by transmitting the hashed password over
the network, making it vulnerable to interception. Copies of system data,
such as system backups written to tape or optical media, can also become a
means for illicitly obtaining hashed passwords. In addition, the functions
used by legitimate password-checking programs need to be written in such a
way that malicious programs cannot make large numbers of authentication checks
at high rates of speed. On a system without shadowed passwords,
the passwd file holds the following user information for each user account:
Username Salt combined with the current hash of
the user's password Password expiration information
User ID Default group ID
Full name Home directory path
Login shell The passwd file is readable by all users
so that name service switch can work, but only the root user can write to it.
This means that an attacker with unprivileged access to the system can
obtain the hashed form of every user's password. Those values can be used to
mount a brute force attack offline, testing possible passwords against the
hashed passwords relatively quickly without alerting system security
arrangements designed to detect an abnormal number of failed login
attempts. Especially when the hash is not salted it is also possible to lookup
these hashed passwords in Rainbow tables, databases specially made for
giving back a password for a unique hash.
With a shadowed password scheme in use, the passwd file typically shows a
character such as '*', or 'x' in the password field for each user instead of
the hashed password, and shadow usually contains the following user information:
User login name salt and hashed password OR a status
exception value e.g.: "$id$salt$hashed", the printable form of
a password hash as produced by crypt, where "$id" is the algorithm used.,
"$5$" is SHA-256 and "$6$" is SHA-512, crypt(3) manpage, other Unix may have
different values, like NetBSD. Key stretching is used to increase password
cracking difficulty, using by default 1000 rounds of modified MD5, 64 rounds
of Blowfish, 5000 rounds of SHA-256 or SHA-512. The number of rounds may be
varied for Blowfish, or for SHA-256 and SHA-512 by using e.g.
"$6$rounds=50000$".) Empty string – No password, the account
has no password. "!" – the account is password locked,
user will be unable to log-in via password authentication but other
methods may be still allowed) "*LK*" or "*" – the account is locked,
user will be unable to log-in via password authentication but other
methods may be still allowed) "!!" – the password has never been set
Days since epoch of last password change Days until change allowed
Days before change required Days warning for expiration
Days before account inactive Days since epoch when account expires
Reserved The format of the shadow file is simple,
and basically identical to that of the password file, to wit, one line per
user, ordered fields on each line, and fields separated by colons. Many systems
require the order of user lines in the shadow file be identical to the order of
the corresponding users in the password file.
History Password shadowing first appeared in
UNIX systems with the development of System V Release 3.2 in 1988 and BSD4.3
Reno in 1990. But, vendors who had performed ports from earlier UNIX
releases did not always include the new password shadowing features in their
releases, leaving users of those systems exposed to password file attacks.
System administrators may also arrange for the storage of passwords in
distributed databases such as NIS and LDAP, rather than in files on each
connected system. In the case of NIS, the shadow password mechanism is often
still used on the NIS servers; in other distributed mechanisms the problem of
access to the various user authentication components is handled by
the security mechanisms of the underlying data repository.
In 1987 the author of the original Shadow Password Suite, Julie Haugh,
experienced a computer break-in and wrote the initial release of the Shadow
Suite containing the login, passwd and su commands. The original release,
written for the SCO Xenix operating system, quickly got ported to other
platforms. The Shadow Suite was ported to Linux in 1992 one year after the
original announcement of the Linux project, and was included in many early
distributions, and continues to be included in many current Linux
distributions. In the past, it was necessary to have
different commands to change passwords in different authentication schemes. For
example, the command to change a NIS password was yppasswd. This required
users to be aware of the different methods to change passwords for
different systems, and also resulted in wasteful duplication of code in the
various programs that performed the same functions with different back ends. In
most implementations, there is now a single passwd command, and the control
of where the password is actually changed is handled transparently to the
user via pluggable authentication modules. For example, the type of hash
used is dictated by the configuration of the pam_unix.so module. By default, the
MD5 hash has been used, while current modules are also capable of stronger
hashes such as blowfish, SHA256 and SHA512.
See also chfn
chsh Crypt
getent Key derivation function
Unix security vipw
References External links
Manual page from Unix First Edition describing passwd
passwd(1): update a user's authentication token(s) – FreeBSD
General Commands Manual authconfig, a command-line tool for
controlling the use of shadow passwords Example shadow file showing the general
layout of the file