In this lecture, we'll discuss how the Linux system performs authentication. 1
There are two files of particular interest to us: /etc/passwd and /etc/shadow. 2
The /etc/passwd file contains basic information about each user account on the system. 3
Let's see the contents of the file. 4
I'm opening it using less. 5
Each line of the file represents a single account of type, normal user or system user 6
and there are seven fields on each line. 7
Let's take these fields one by one. 8
The first field is the user's login name. 9
The second field, at the beginning of the Unix era, used to contain an encrypted password. 10
Nowadays, it contains the letter X to denote that a password has been assigned but was saved in 11
another file, the shadow file. 12
If this second field is blank, the user does not need to enter a password to log in. 13
The third field is the user ID, a positive integer number assigned to the user, followed by the group 14
ID in the fourth field. 15
The fifth field is a comment. 16
Sometimes it is left blank. 17
The next field is the user's home directory. 18
And finally, the last field is the default shell usually set to /bin/bash. 19
If instead of bash you see there nologin of false it means there is a system user that’s 20
not allowed to log into the system. 21
That was the format of etc password. 22
I'm exiting the file by pressing on q. 23
Let’s go ahead and take a look at the format of /etc/shadow. 24
This is the file. 25
It stores the actual passwords of the users in an encrypted format. 26
In fact, there is the hash of the password with additional properties related to users' passwords 27
like password expiration dates. 28
The /etc/passwd file is world-readable and that means that any user can read it but the shadow 29
file, this file, is only readable by the root account. 30
Let's take a deeper look at the content of the shadow file. 31
Each line of the file contains nine comma separated fields: the first field is the user name, and this 32
is how a line in the shadow file is connected to the corresponding line in the password file. 33
The second field represents the password, the entire string between these two colonies. 34
This is the password. 35
Then come 7 fields related to password expiration date like last password change, minimum and 36
maximum passport age and so on. 37
I won’t dive deeper into this, but if you are interested you can find a full description of these 38
fields in the man page of the shadow file. man shadow 39
You find here a full description of each field. 40
Let's get back to the shadow file; if the password field contains an asterisk or an exclamation point 41
the user will not be able to login to the system using the password authentication. Other login 42
methods like key-based authentication or switching to the user are still allowed. 43
This is the case of root in the latest version of Kali Linux. 44
Let’s take a deeper look at the password field! 45
This selected field. 46
Usually the password format is set to $type, in this case $6, $salt and 47
$hashed. 48
The type, 6 in this case, is the cryptographic hash algorithm used and can have the following values: 49
1$ means MD5; $2a means Blowfish; $2y means Eksblowfish; 5$ means SHA-256; and 50
6$ 51
this case, means SHA-512. 52
Then comes the salt, this part and then the hash of the password and the salt together. 53
This part. 54
This is the hash calculated using in this case SHA 512, which is an extremely strong algorithm. 55
Let me tell you a few words about the salt, this field in this example. A salt combined with the pastword 56
is added to the hashing process to enforce the uniqueness of the outhash or in other words, 57
the same password will give different hashes because of this random alt. This mitigate password attacks 58
like rainbow tables, 59
the salt is randomly generated for each password, but it’s not secret like the password is. 60
If through having the hash an attacker can find the clear text password, all the other similar 61
passwords of other users are still secure because their hash is different. 62
To make it crystal clear, let me show you an example, I'm exiting the shadow file by pressing on cue 63
and I'll create two user accounts. 64
They will have the same password. 65
I'm creating the first user named User 1 and then set its password to test: useradd user1 66
The user was created; let's set a password to test: password user1, and I'm typing test two times. 67
Let's create the second user named user2, with the same password: test useradd user2. 68
passwd user2 and I'm typing test 2 times. 69
Now let's check the hashes in the shadow file. 70
I am printing out the last 10 lines. 71
These are the lines related to the users I've just created. 72
And we notice that even though both users have the same password, the saved hash is different. 73
It is unique. 74
That's because it has computed the hash using both the common password and the salt, which is unique 75
for each user. 76
Now, if a hacker manages to find the password of the first user having the hash, the hacker doesn't 77
know that the second user has the same password because there is another hash in the file. 78
One last thing I want to tell you is that these files, Password and Shadow, should not be edited by 79
hand unless you know what you are doing. 80
Always use a command that is designed for this purpose. 81
That's all; now that you know where the passwords are stored on a Linux system, I'll go ahead and show 82
you in the next lectures how the Linux groups are organized and how to manage users in groups.