On a system using shadowed passwords, the most correct permissions for /etc/passwd are ___ and the most correct permissions for /etc/shadow are _________.

Question

Options

• A-rw-r-----, -r--------
• B-rw-r--r--, -r--r--r--
• C-rw-r--r--, -r--------
• D-rw-r--rw-, -r-----r--
• E-rw-------, -r--------

• A
  4% (1)
• B
  15% (4)
• C
  70% (19)
• D
  4% (1)
• E
  7% (2)

Explanation

Option C correctly reflects the security model behind shadowed passwords: /etc/passwd must be world-readable (-rw-r--r--, 644) because countless system utilities-ls, ps, id-need to map numeric UIDs to usernames, while /etc/shadow must be readable only by root (-r--------, 400) since it holds the actual password hashes that shadowing exists to protect.

Why the distractors fail:

• A (-rw-r----- for passwd): Removes world-read, breaking any program that resolves UIDs for non-root users.
• B (-r--r--r-- for shadow): Makes shadow world-readable, completely defeating the purpose of password shadowing.
• D (-rw-r--rw- for passwd): World-writable passwd is a critical vulnerability-any user could add a root account; shadow's r-----r-- also leaks hashes to "others."
• E (-rw------- for passwd): Owner-only read breaks UID-to-username resolution for all non-root processes.

Memory tip: Use the phrase "passwd is a phonebook, shadow is a vault." A phonebook (passwd) must be readable by everyone to be useful-644. A vault (shadow) is opened only by the owner-400. If shadow ever has a bit set in the group or other columns, that's a red flag on the exam.

No community discussion yet for this question.