Shadow password

From Wikipedia, the free encyclopedia

This article needs additional citations for verification.
Please help improve this article by adding reliable references. Unsourced material may be challenged and removed. (February 2008)

The shadow password file mechanism is used to increase the security level of passwords on Unix-like systems by preventing ordinary users from being able to access encrypted password data.

1 Unshadowed passwords
2 Shadowed passwords
3 History
4 See also
5 References

[edit] Unshadowed passwords

On a system without shadowed passwords, /etc/passwd holds the following user information:

Username
Salt and hashed password
Password expiration information
User ID (UID)
Default group ID (GID)
Full name
Home directory path
Login shell

The file is world-readable (its contents are visible to all users), but only writable by root. This means that an attacker with access to the system at normal privilege level can obtain the hashed form of every user's password. These can then be used to mount a brute force attack offline, using the hashed passwords as a relatively fast way to test guessed passwords without alerting system security modules designed to detect an abnormal number of failed login attempts. Most users select passwords that are vulnerable to such password cracking techniques.^[1]

[edit] Shadowed passwords

One way to reduce brute force attacks is to make the hashed password unreadable by unprivileged users, and the obvious way to do this is to make the passwd file itself readable only by the root user. However, this would also restrict access to other data in the file such as username-to-userid mappings, which would break many functions on the system. Thus the idea of a "shadow" password file was conceived, where the passwd file remains world-readable but users' hashed passwords are moved to a separate file—usually /etc/shadow on Linux and Unix systems or /etc/master.passwd on BSD systems—which can be read only by root. (Root access to the data is considered acceptable since on systems with the traditional "all-powerful root" security model, the root user would be able to obtain this information by other means.) Virtually all modern Unix-like operating systems use shadowed passwords.

When passwords are shadowed, the /etc/passwd file shows a character such as '*', or x' instead of the hashed password, and /etc/shadow holds the following user information:

User login name
salt and hashed password
Days since epoch of last password change
Days until change allowed
Days before change required
Days warning for expiration
Days before account inactive
Days since Epoch when account expires
Reserved

While the hashed password is the most important information in the shadow file, the file usually contains other fields as well, such as the last time the password was changed, when the password will expire, and whether the account is disabled. The format of the shadow file is simple and is basically identical to that of the password file: one line per user, ordered fields on each line, and fields separated by colons. Many systems specify that the order of user lines in the shadow file should be identical to the order of the corresponding users in the password file.

The contents of the file is usually modified by the passwd program, which in turn is largely dependent on PAM. For example, the type of hash used is dictated by the configuration of the pam_unix.so module. By default the MD5 hash is used, while the newer pam_unix2.so module is also capable of stronger hashes such as blowfish.

It is worth noting that the shadow password file does not entirely solve the problem of access to hashed passwords, as some network authentication schemes operate by transmitting the encrypted password over the network, making it vulnerable to interception. Alternate copies of system data, such as system backups written to tape or optical media, can also become a means for illicitly obtaining hashed passwords. In addition, the functions used by legitimate password-checking programs need to be written in such a way that malicious programs cannot make large numbers of authentication checks at high rates of speed.

[edit] History

Password shadowing was introduced in UNIX systems with the release of System V Release 3.2 and BSD4.3 Reno. Vendors which had performed ports from earlier UNIX releases did not include the new password shadowing features, leaving users of those systems exposed to password file attacks.

In 1987 the author of the original Shadow Password Suite, Julie Haugh, experienced a computer breakin and wrote the initial release of the Shadow Suite containing just the login, passwd and su commands. The original release was written for the SCO Xenix operating system, but was quickly ported to other platforms. The Shadow Suite was ported to Linux in 1992 and became a part of many early distributions.

Passwords may also be stored in distributed databases such as NIS and LDAP, rather than in plaintext files on each system. In the case of NIS, the shadow password mechanism is often still used on the NIS servers; in other distributed mechanisms the problem of access to the various user authentication components is handled by the security mechanisms of the underlying data repository.