Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is it stored in plain text or not?

Where can I find the file that contains the username and password for my accounts in Ubuntu 13.04?

share|improve this question
7  
Basic Linux knowledge. /etc/passwd - /etc/shadow –  Stolas Jun 5 '13 at 8:10
add comment

2 Answers 2

up vote 10 down vote accepted

I have never seen a unix system that stores passwords in plain text. Traditional unix systems used a hash construction based on DES (which included a salt, but truncated the password to 8 characters and did not perform any slowdown). In the late 1990s most systems switched to a password hashing scheme based on MD5, with salt and a non-configurable slowdown. Nowadays most Linux distributions, including Ubuntu, use a scheme based on SHA-2 with salt and a configurable slowdown. You can tell the password scheme from the first characters in the password field; $6$ indicates a SHA-512-based scheme.

Password hashes were traditionally stored in /etc/passwd, but modern systems keep the passwords in a separate file from the public user database. Linux uses /etc/shadow. You can put passwords in /etc/passwd (it's still supported for backward compatibility), but you have to reconfigure the system to do that.

So the answer for you is: no, it isn't in plain text (and there's no way to make it in plaintext even through misconfiguration). The hash is in /etc/shadow.

share|improve this answer
1  
Ubuntu 5.10 had the root password stored in plaintext, but this was patched very quickly after it was discovered and doesn't affect any later (or earlier) version at all. That's probably what the OP was thinking of. –  evilsoup Jun 5 '13 at 10:57
add comment

Passwords are not stored in plain text but are salted and encrypted in the /etc/shadow file. Let's discuss how this works in Linux as there are two important files the /etc/shadow and the /etc/passwd

The /etc/passwd file is the file in Linux system that contains all the relevant information related to user login (original article here):

  1. Username: It is used when user logs in. It should be between 1 and 32 characters in length.
  2. Password: An x character indicates that encrypted password is stored in /etc/shadow file.
  3. User ID (UID): Each user must be assigned a user ID (UID). UID 0 (zero) is reserved for root and UIDs 1-99 are reserved for other predefined accounts. Further UID 100-999 are reserved by system for administrative and system accounts/groups.
  4. Group ID (GID): The primary group ID (stored in /etc/group file)
  5. User ID Info: The comment field. It allow you to add extra information about the users such as user's full name, phone number etc. This field use by finger command.
  6. Home directory: The absolute path to the directory the user will be in when they log in. If this directory does not exists then users directory becomes /.
  7. Command/shell: The absolute path of a command or shell (/bin/bash). Typically, this is a shell. Please note that it does not have to be a shell.

The /etc/shadow file contains encrypted password entries for users in the system. Beside containing encrypted passwords, an entry in this file also contains ageing and expiration information of password. Ubuntu uses the crypt function:

The glibc2 version of this function supports additional encryption algorithms.

If salt is a character string starting with the characters "$id$" followed by a string terminated by "$":

     $id$salt$encrypted

then instead of using the DES machine, id identifies the encryption method used and this then determines how the rest of the password string is interpreted. The following values of id are supported:

     ID  | Method
     ---------------------------------------------------------
     1   | MD5
     2a  | Blowfish (not in mainline glibc; added in some
         | Linux distributions)
     5   | SHA-256 (since glibc 2.7)
     6   | SHA-512 (since glibc 2.7)

So $5$salt$encrypted is an SHA-256 encoded password and $6$salt$encrypted is an SHA-512 encoded one.

"salt" stands for the up to 16 characters following "$id$" in the salt. The encrypted part of the password string is the actual computed password. The size of this string is fixed:

MD5     | 22 characters SHA-256 | 43 characters SHA-512 | 86 characters

The characters in "salt" and "encrypted" are drawn from the set [a-zA-Z0-9./]. In the MD5 and SHA implementations the entire key is significant (instead of only the first 8 bytes in DES).

share|improve this answer
    
Note that the meaning of user IDs (other than the special value 0) is undefined as far as the OS is concerned. Any meaning attributed to them is a result of operation policy. The values shown here are probably fairly common, but you cannot rely on them always being like that even on Linux. –  Michael Kjörling Jun 5 '13 at 10:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.