312-50V11 · Question #45
A hacker has managed to gain access to a Linux host and stolen the password file from /etc/passwd. How can he use it?
The correct answer is B. The password file does not contain the passwords themselves. On modern Linux systems, /etc/passwd stores user account metadata but actual password hashes are stored in /etc/shadow, making the passwd file useless for direct password recovery.
Question
A hacker has managed to gain access to a Linux host and stolen the password file from /etc/passwd. How can he use it?
Options
- AThe file reveals the passwords to the root user only.
- BThe password file does not contain the passwords themselves.
- CHe cannot read it because it is encrypted.
- DHe can open it and read the user ids and corresponding passwords.
How the community answered
(54 responses)- A4% (2)
- B93% (50)
- C2% (1)
- D2% (1)
Why each option
On modern Linux systems, /etc/passwd stores user account metadata but actual password hashes are stored in /etc/shadow, making the passwd file useless for direct password recovery.
The /etc/passwd file does not reveal passwords for any user including root - it only stores a placeholder 'x' in the password field for all accounts.
Modern Linux systems use shadow password files (/etc/shadow) to store hashed passwords, not /etc/passwd. The /etc/passwd file is world-readable and contains fields like username, UID, GID, home directory, and shell - but the password field contains only an 'x' placeholder, meaning a stolen /etc/passwd alone cannot be used to recover credentials.
The /etc/passwd file is not encrypted; it is a plaintext file readable by all users, but it simply does not contain password data.
While /etc/passwd does contain user IDs, it does not contain corresponding passwords - those are stored in /etc/shadow with restricted permissions.
Concept tested: Linux shadow password file security
Source: https://man7.org/linux/man-pages/man5/passwd.5.html
Topics
Community Discussion
No community discussion yet for this question.