Dissecting the Linux /etc/shadow File: Password Hashes and Aging Fields
In Linux, user account definitions reside in /etc/passwd (world-readable), while encrypted password hashes and credential aging rules reside in /etc/shadow (restricted to root with 0640 or 0600 permissions). Understanding /etc/shadow field definitions is essential for system auditing, incident response, and credential analysis. Anatomy of an /etc/shadow Entry Each line consists of 9 colon-separated fields: n1x:$6$UoDmVdoW$tYQQm5uHgOpe...:16631:7:15:2:14:16819: Field # Attribute Name Value in Example Description 1 Username n1x Account login name matching /etc/passwd. 2 Encrypted Password $6$UoDmVdoW$... Cryptographic hash prefixed by algorithm identifier. 3 Last Changed Date 16631 Days since the Unix Epoch (Jan 1, 1970) when password was last updated. 4 Minimum Age 7 Days user must wait before they can change password again. 5 Maximum Age 15 Days before the password expires and must be changed. 6 Warning Period 2 Days prior to expiration that warning prompts begin displaying. 7 Inactivity Period 14 Days after expiration during which user can still change password; past this, account is disabled. 8 Expiration Date 16819 Absolute date (in days since epoch) when account is permanently disabled. 9 Reserved (empty) Flag reserved for future operating system use. Identifying Password Hash Algorithms The second field begins with $id$salt$hash. The ID reveals the cryptographic hashing algorithm used: ...