nerdexam
GIAC

GSEC · Question #218

What does the "x" character in the second field of the user account record of the /etc/passwd file indicate?

The correct answer is A. The user account is using a shadow password. In Linux, an 'x' in the password field of /etc/passwd indicates that the user's encrypted password is stored in the /etc/shadow file rather than directly in /etc/passwd.

Linux and Cryptography

Question

What does the "x" character in the second field of the user account record of the /etc/passwd file indicate?

Options

  • AThe user account is using a shadow password.
  • BThe user account is shared by more than one user.
  • CThe user account is disabled.
  • DThe user account does not exist.

How the community answered

(24 responses)
  • A
    79% (19)
  • B
    4% (1)
  • C
    4% (1)
  • D
    13% (3)

Why each option

In Linux, an 'x' in the password field of /etc/passwd indicates that the user's encrypted password is stored in the /etc/shadow file rather than directly in /etc/passwd.

AThe user account is using a shadow password.Correct

When the second field of an /etc/passwd entry contains 'x', it signals to the system that the actual password hash is stored in /etc/shadow rather than in /etc/passwd itself. This shadow password mechanism restricts access to password hashes since /etc/shadow is only readable by root, unlike /etc/passwd which is world-readable, thereby improving security.

BThe user account is shared by more than one user.

Sharing an account among multiple users is not indicated by any character in the password field - Linux user accounts are identified by UID and there is no such field marker for shared accounts.

CThe user account is disabled.

A disabled account is typically indicated by '!' or '*' in the password hash field of /etc/shadow, not by 'x' in the /etc/passwd password field.

DThe user account does not exist.

A non-existent account would simply not have an entry in /etc/passwd at all - the presence of any record in the file means the account has been defined on the system.

Concept tested: Linux /etc/passwd shadow password field indicator

Source: https://man7.org/linux/man-pages/man5/passwd.5.html

Topics

#/etc/passwd#shadow passwords#Linux authentication#password storage

Community Discussion

No community discussion yet for this question.

Full GSEC Practice