GPEN · Question #414
How can a non-privileged user on a Unix system determine if shadow passwords are being used?
The correct answer is B. Read /etc/shadow and look for "x" or "II" in the second colon-delimited field. Shadow passwords on Unix systems store hashed credentials in /etc/shadow, with specific field markers indicating when shadow authentication is active.
Question
How can a non-privileged user on a Unix system determine if shadow passwords are being used?
Options
- ARead /etc/password and look for "x" or "II" in the second colon-delimited field
- BRead /etc/shadow and look for "x" or "II" in the second colon-delimited field
- CVerify that /etc/password has been replaced with /etc/shadow
- DRead /etc/shadow and look NULL values In the second comma delimited field
How the community answered
(43 responses)- A5% (2)
- B79% (34)
- C2% (1)
- D14% (6)
Why each option
Shadow passwords on Unix systems store hashed credentials in /etc/shadow, with specific field markers indicating when shadow authentication is active.
The filename /etc/password does not exist as a standard Unix file; the correct filename is /etc/passwd, making this option based on an incorrect file reference.
When shadow passwords are enabled, /etc/shadow holds the actual password hashes, and the second colon-delimited field uses markers such as 'x' or '!!' to denote shadow-enabled or locked accounts. Examining this field directly confirms whether the shadow password mechanism is configured and active on the system.
Shadow passwords do not replace /etc/passwd; both files coexist, with /etc/passwd retaining user account metadata while /etc/shadow stores the password hashes.
/etc/shadow uses colon-delimited fields, not comma-delimited fields, so referencing comma-delimited NULL values reflects a fundamentally incorrect understanding of the file format.
Concept tested: Unix shadow password file format and field indicators
Source: https://www.man7.org/linux/man-pages/man5/shadow.5.html
Topics
Community Discussion
No community discussion yet for this question.