nerdexam
GIAC

GCFA · Question #156

In which of the following files does the Linux operating system store passwords?

The correct answer is C. Shadow. Modern Linux systems store hashed user passwords in /etc/shadow, which is readable only by root, rather than the world-readable /etc/passwd file.

Advanced Mac & Linux Forensics

Question

In which of the following files does the Linux operating system store passwords?

Options

  • APassword
  • BPasswd
  • CShadow
  • DSAM

How the community answered

(20 responses)
  • B
    10% (2)
  • C
    85% (17)
  • D
    5% (1)

Why each option

Modern Linux systems store hashed user passwords in /etc/shadow, which is readable only by root, rather than the world-readable /etc/passwd file.

APassword

'Password' is not a recognized Linux system file - no such file path exists in the standard Linux filesystem hierarchy for credential storage.

BPasswd

/etc/passwd stores user account information such as username, UID, GID, home directory, and shell, but on modern systems it contains only an 'x' placeholder in the password field, not actual hashed passwords.

CShadowCorrect

The /etc/shadow file stores the hashed passwords for all user accounts on a Linux system, along with password aging and expiration metadata. It replaced the practice of storing hashed passwords in /etc/passwd because shadow is restricted to root access only, preventing unprivileged users from obtaining password hashes for offline cracking. This separation of account information from credential storage is a foundational Linux security control.

DSAM

SAM (Security Account Manager) is a Windows registry database file used by Windows operating systems to store password hashes, and it has no equivalent role in Linux.

Concept tested: Linux /etc/shadow file and password storage

Source: https://man7.org/linux/man-pages/man5/shadow.5.html

Topics

#Linux password storage#shadow file#/etc/shadow#credential files

Community Discussion

No community discussion yet for this question.

Full GCFA Practice