Which file contains the data of the last change of a user's password?

The correct answer is E. /etc/shadow. /etc/shadow stores hashed passwords and password aging metadata for each user, including a field for the date of the last password change (stored as days since the Unix epoch). This makes it the definitive source for password history timestamps. Why the distractors are wrong…

Security

Question

Which file contains the data of the last change of a user's password?

Options

A/etc/gshadow
B/etc/passwd
C/etc/pwdlog
D/var/log/shadow
E/etc/shadow

How the community answered

(34 responses)

A
15% (5)
B
3% (1)
C
6% (2)
D
3% (1)
E
74% (25)

Explanation

/etc/shadow stores hashed passwords and password aging metadata for each user, including a field for the date of the last password change (stored as days since the Unix epoch). This makes it the definitive source for password history timestamps.

Why the distractors are wrong:

A. /etc/gshadow - stores group password and membership data, not user password info
B. /etc/passwd - historically stored passwords but now only holds account metadata (UID, shell, home dir); passwords were moved out for security reasons
C. /etc/pwdlog - this file does not exist on standard Linux systems
D. /var/log/shadow - also non-existent; /var/log/ holds system logs, not password databases

Memory tip: Think "shadow follows passwd." /etc/passwd is the visible account file, and /etc/shadow is its secure counterpart hidden in the shadows - storing everything sensitive, including when the password last changed. The chage -l <user> command reads directly from /etc/shadow to display this information.

Topics

#password storage#shadow file#/etc/shadow#authentication

Community Discussion

No community discussion yet for this question.

Full 102-500 Practice