
	Where results make sense

Topic: Shadow password

	Shadow password - Wikipedia, the free encyclopedia
		The process of shadowing passwords is used to increase the security level of passwords on Unix systems, by hiding the encrypted passwords from ordinary users.
		Password shadowing was introduced in UNIX systems with the release of System V Release 3.2 and BSD4.3 Reno.
		The Shadow Suite was ported to Linux in 1992 and became a part of many early distributions.
	en.wikipedia.org /wiki/Shadow_password (441 words)

	Password's Progress \| Linux Journal
		To log in to an account, users enter a password of up to eight characters (it was six or seven in the past), and the password is encrypted into a key using the DES (data encryption standard) algorithm.
		Shadow passwords get their name because they are the hidden counterparts of basic passwords.
		The number of users whose password is ``password'' or the name of their youngest daughter or goldfish is too depressing for words.
	www.linuxjournal.com /article/4846 (1958 words)

	GeodSoft How-To: Password Basics: Storage and Terms
		When the user next logs in, their password is passed through the same encryption process and if the result equals the saved hash, the user is allowed entry since they provided the correct password.
		The password hashes were no longer placed in /etc/passwd but the shadow password file, often /etc/shadow, which should be readable only by root.
		A bad password is one that is too weak for the resources it's supposed to defend or that is too difficult for users to use and remember.
	geodsoft.com /howto/password/password_basics.htm (2267 words)

	Passwords, Users, Groups, and Quotas
		The password is given to the function, and the function generates an output.
		Therefore the way "crack" password cracking programs work is to get a copy of your system password file and try to guess at the password, running it through the one way hash function until it gets a match.
		password - password in encrypted form, which is 13 to 24 characters long.
	www.comptechdoc.org /os/linux/howlinuxworks/linux_hlshadow.html (1854 words)

	Solaris 2.5.1 man page: shadow(4)
		The shadow file can be used in conjunction with other shadow sources, including the NIS maps passwd.byname and passwd.byuid and the NIS+ table passwd.
		A 13-character encrypted password for the user, a lock string to indicate that the login is not accessible, or no string, which shows that there is no password for the login.
		If password aging is turned on in any name service the passwd: line in the /etc/nsswitch.conf file must have a format specified in the nsswitch.conf(4) man page.
	www.cae.wisc.edu /manuals/unix-man/solaris-2.5.1/shadow.4.html (318 words)

	Linux HOWTOs: Linux Shadow Password HOWTO: Putting the Shadow Suite to use. (Site not responding. Last check: 2007-10-15)
		Changing password for fred Enter the new password (minimum of 5 characters) Please use a combination of upper and lower case letters and numbers.
		file, and a user were to change his password while you are editing, and then you were to save the file you were editing, the user's password change would be lost.
		's password is valid, it was last changed on 03/04/96, it can be changed at any time, it expires after 60 days, fred will not be warned, and and the account won't be disabled when the password expires.
	nixdoc.net /Linux-Howtos/Shadow-Password-HOWTO-7.html (1436 words)

	Shadow password encryption - LinuxQuestions.org
		The encryped password consists of 13 to 24 characters from the 64 character alphabet a thru z, A thru Z, 0 thru 9,.
		If you ask a cryptography expert, however, he or she will tell you that the password is actually in an encoded rather than encrypted format because when using crypt(3), the text is set to null and the password is the key.
		The algorithm used to encode the password field is technically referred to as a one way hash function.
	www.linuxquestions.org /questions/showthread.php?t=186734 (668 words)

	[No title]
		However, Shadow Suite versions 3.3.1, 3.3.1-2, and shadow-mk all have security problems with their login program and several other suid root programs that came with them, and should no longer be used.
		By moving the passwords to the /etc/shadow file, we are effectively keeping the attacker from having access to the encoded passwords with which to perform a dictionary attack.
		If you were editing the /etc/shadow file, and a user were to change his password while you are editing, and then you were to save the file you were editing, the user's password change would be lost.
	web.mit.edu /linux/docs/old-HOWTO/Shadow-Password-HOWTO (7821 words)

	Authenticate Program : Authenticating Userid and Password Pairs
		Encrypted passwords are stored in a separate file that is readable only by a user that has root privileges.
		Note: The password that you set up and the one that was used to log on to the system do not have to be the same.
		The password is valid because the exit status is 0.
	www.asu.edu /sas/sasdoc/sashtml/comm/zpauthen.htm (832 words)

	What is shadow password file? - a definition from Whatis.com
		The original password is encrypted (or encoded) by using a randomly-generated value or encryption key between 1 and 4096 and a one-way hashing function to arrive at the encoded password that is actually stored.
		Note the key itself can't be used to decode the encrypted/encoded password because the encoding is one-way.
		When someone enters a password, their password is then rehashed with the salt value and compared with the encoded password value.
	searchsecurity.techtarget.com /sDefinition/0,,sid14_gci213435,00.html (477 words)

	Linux.com - Linux Shadow Password HOWTO: Adding shadow support to a C program
		For adding shadow support to a program so that it can check passwords, but otherwise does need to run as root, it's a lot safer to run the program SUID shadow instead.
		The author of the Shadow Suite indicates that since most programs in existence don't do this, and that it may be removed or changed in future versions of the Shadow Suite.
		This is an example of adding shadow support to a program that needs it, but does not have it by default.
	www.linux.com /howtos/Shadow-Password-HOWTO-8.shtml (1003 words)

	shadow password file - a Whatis.com definition
		In the Linux operating system, a shadow password file is a system file in which encryption user password are stored so that they aren't available to people who try to break into the system.
		Assuming that the system was lax in its password creation requirements and some user used one of the many commonly-used passwords, at least one password could be discovered.
		Using a shadow password file requires that the Linux system installer also install the optional Shadow Suite, which, like Linux, is open source software and available from a number of sites on the Web.
	whatis.techtarget.com /gDefinition/0,294236,sid43_gci213435,00.html (418 words)

	Commercial Security
		The default values are a password lifetime of 28 weeks, and an expiration time of 26 weeks.
		Individual password aging values are stored in the new 10.x protected password database, which contains a password file for each user.
		The aging cycle for all passwords will be restarted when you upgrade a trusted system to 10.01.
	docs.hp.com /en/5964-5283/ch05s02.html (887 words)

	Protecting Yourself from Password File Attacks
		Ensure that good passwords are selected so that they cannot easily be cracked, or use a technology in which passwords are not located in the password file.
		Instead, the encrypted passwords are held in a shadow file that is not world-readable.
		Consult your system manuals to determine whether or not a shadow password capability is available on your system and to get information on how to set up and manage such a facility.
	www.cert.org /tech_tips/passwd_file_protection.html (827 words)

	Shadow Password Suite - Andamooka Reader (Site not responding. Last check: 2007-10-15)
		The Shadow Password Suite contains the chage, chfn, chsh, expiry, faillog, gpasswd, lastlog, login, newgrp, passwd, sg, su, chpasswd, dpasswd, groupadd, groupdel, groupmod, grpck, grpconv, grpunconv, logoutd, mkpasswd, newusers, pwck, pwconv, pwunconv, useradd, userdel, usermod and vipw programs.
		chage changes the number of days between password changes and the date of the last password change.
		With the -s flag, they will edit the shadow versions of those files, /etc/shadow and /etc/gshadow, respectively.
	www.andamooka.org /reader.pl?pgid=lfsaa_shadow (531 words)

	ITworld.com - LINUX TIPS AND TRICKS - Passwd and Shadow Files
		This number is attached to the user's processes and thus enables the sysadmin to associate the currently active processes to their users.
		Shadowing systems store users' password and associated rules in a special file called /etc/shadow.
		When a shadowing system is in use, the passwd file remains readable but it doesn't contain passwords anymore.
	www.itworld.com /nl/lnx_tip/08102001 (648 words)

	Linuxarkivet: Howto (Site not responding. Last check: 2007-10-15)
		Even though the shadow suite contains replacement programs for most programs that need to access passwords, there are a few additional programs on most systems that require access to passwords.
		for a discussion on how to put shadow support into any other program that needs it (although the program must then be run SUID root or SGID shadow to be able to actually access the shadow file).
		The documentation that comes with the package states that the default for Linux systems is to include support for shadow.
	www.linuxarkivet.se /howto/Shadow-Password-HOWTO/x546.html (2222 words)

	using /etc/shadow with mod_auth_pam
		The normal problem with accessing a shadow password file from Apache is that that the shadow password file is not readable to everyone, so Apache can't read it.
		The whole point of having a shadow password file is limiting access to some well known services (root, that is), so that hackers are prevented from running a password-cracker over it.
		A solution for making only Apache able to read the password shadow file is chgrp'ing the shadow password file to some new group (for example "shadow-readers"), then placing this line into your httpd.conf:
	pam.sourceforge.net /mod_auth_pam/shadow.html (170 words)

	Linux Shadow Password HOWTO: Installing
		Even if you are brave enough install the Shadow Suite without making backups, you will still want to remove the old manual pages.
		The new manual pages won't normally overwrite the old ones because the old ones are probably compressed.
		None of the users on the system should actually be in the shadow group.
	www.stanford.edu /~security/unix/Linux/Shadow-Password-HOWTO-5.html (473 words)

	Linux.com - Linux Shadow Password HOWTO: Why shadow your passwd file?
		The current maintainer of the Shadow Suite, Marek Michalkiewicz received the source code from the original author under a BSD style copyright that allowed redistribution.
		Installing the Shadow Suite contributes toward a more secure system, but there are many other things that can also be done to improve the security of a Linux system, and there will eventually be a series of Linux Security HOWTO's that will discuss other security measures and related issues.
		Your machine runs other software that validates users, and there is no shadow version available, and you don't have the source code.
	www.linux.com /howtos/Shadow-Password-HOWTO-2.shtml (1697 words)

	freshmeat.net: Project details for shadow (Site not responding. Last check: 2007-10-15)
		The Shadow password file utilities package includes the programs necessary to convert traditional V7 UNIX password files to the SVR4 shadow password format, and additional tools to maintain password and group files (that work with both shadow and non-shadow passwords).
		Now only Shadow 20000902 is available, but 19990827, the version shipped with Slackware 7.1 is still linked as current (lrwxrwxrwx 1 root root 22 Feb 12 2000 shadow-current.tar.gz -> shadow-19990827.tar.gz).
		If all goes well, Shadow should be stable enough for general use within a few months.
	freshmeat.net /projects/shadow (415 words)

	Linux HOWTOs: Linux Shadow Password HOWTO: Other programs you may need to upgrade or patch (Site not responding. Last check: 2007-10-15)
		See the section Adding Shadow Support to a C program for a discussion on how to put shadow support into any other program that needs it (although the program must then be run SUID root or SGID shadow to be able to actually access the shadow file).
		A shadow version of this program can be obtained from ftp://sunsite.unc.edu/pub/Linux/ system/Admin/accounts/adduser.shadow-1.4.tar.gz.
		See the section on Putting the Shadow Suite to use for more information.
	nixdoc.net /Linux-Howtos/Shadow-Password-HOWTO-6.html (959 words)

	Linux Shadow Password HOWTO: Why shadow your passwd file?
		If you think about it, an 8 character password encodes to 4096 * 13 character strings.
		Days since Jan 1, 1970 that password was last changed
		Hence, password selection should, at minimum, avoid common words and names.
	www.tldp.org /HOWTO/Shadow-Password-HOWTO-2.html (1631 words)

	Linux Shadow Password HOWTO: Why shadow your passwd file?
		Installing the Shadow Suite contributes toward a more secure system, but there are many other things that can also be done to improve the security of a Linux system.
		If your machine runs other software that validates users, and there is no shadow version available, and you don't have the source code you shouldn't install the Shadow Suite.
		You actually can and should shadow a RADIUS server, but you will need a RADUIS server that has been patched to allow shadowed passwords.
	www.kplug.org /~mhjack/SHADOW-HOWTO/SHADOW-HOWTO-3.html (1601 words)

	[No title]
		passwords will be common words (or simple variations of common words).
		Where Np is the salt and ge08pfz4wuk is the encoded password.
		passwords were not used in the first place.
	www.linuxrx.com /HOWTO/sunsite-sources/Shadow-Password-HOWTO.html (6787 words)

	useradd without shadow password - LinuxQuestions.org
		I am playing around a bit with passwords and in particular the shadow password, One thing that confuses me is when I try to add a password to a newly created user account with the shadow password system turned off (via pwunconv command).
		If I turn on the shadow password system I can add a new password but not with it turned off.
		Perhaps it never adds an entry to shadow, but then the password change tries to change it in shadow.
	www.linuxquestions.org /questions/showthread.php?t=361493 (321 words)

	Password setup - Community Server :: Forums
		after playing with shadow user pro i realize the i havent put in any administrator password so i set it up at options then administrator then put my password.
		At this time, the password feature is only supported when the logged in user is a Limited User (Users who do not have Administrative priveleges.) Any administrator can manage ShadowMode and if there is a password set, any limited user must enter a password.
		my point is having shadowprotect protect itself from unwanted changes, you who only knows the admin password can disable it or uninstall it.
	www.shadowstor.com /Forums/ShowPost.aspx?PostID=76 (350 words)

	Linux HeadQuarters - Linux Shadow Password HOWTO
		This document aims to describe how to obtain, install, and configure the Linux password Shadow Suite.
		3.1 History of the Shadow Suite for Linux
		3.3 What is included with the Shadow Suite.
	www.linuxhq.com /ldp/howto/Shadow-Password-HOWTO.html (163 words)

	Linux Shadow Password HOWTO: Getting the Shadow Suite.
		There are security problems with Shadow versions 3.3.1, 3.3.1-2, and shadow-mk involving the
		The only recommended Shadow Suite is still in BETA testing, however the latest versions are safe in a production environment and don't contain a vulnerable
		is included for writing and/or compiling programs that need to access user passwords.
	www.educ.umu.se /~bjorn/linux/howto/Shadow-Password-HOWTO-3.html (401 words)

Try your search on: Qwika (all wikis)