Passwords are not stored in plain text but are salted and encrypted in the
/etc/shadow file. Let's discuss how this works in Linux as there are two important files the
/etc/shadow and the
/etc/passwd file is the file in Linux system that contains all the relevant information related to user login (original article here):
- Username: It is used when user logs in. It should be between 1 and
32 characters in length.
- Password: An x character indicates that
encrypted password is stored in
- User ID (UID):
Each user must be assigned a user ID (UID). UID 0 (zero) is reserved
for root and UIDs 1-99 are reserved for other predefined accounts.
Further UID 100-999 are reserved by system for administrative and
- Group ID
(GID): The primary group ID (stored
- User ID Info: The comment field. It allow you to
add extra information about the users such as user's full name,
phone number etc. This field use by finger command.
- Home directory:
The absolute path to the directory the user will be in when they log
in. If this directory does not exists then users directory becomes
- Command/shell: The absolute path of a command or shell (
Typically, this is a shell. Please note that it does not have to be
/etc/shadow file contains encrypted password entries for users in the system. Beside containing encrypted passwords, an entry in this file also contains ageing and expiration information of password. Ubuntu uses the crypt function:
The glibc2 version of this function supports additional encryption algorithms.
If salt is a character string starting with the characters "$id$" followed by a string terminated by "$":
then instead of using the DES machine, id identifies the encryption method used and this then determines how the rest of the password string is interpreted. The following values of id are supported:
ID | Method
1 | MD5
2a | Blowfish (not in mainline glibc; added in some
| Linux distributions)
5 | SHA-256 (since glibc 2.7)
6 | SHA-512 (since glibc 2.7)
$5$salt$encrypted is an SHA-256 encoded password and
$6$salt$encrypted is an SHA-512 encoded one.
"salt" stands for the up to 16 characters following "$id$" in the salt. The encrypted part of the password string is the actual computed password. The size of this string is fixed:
MD5 | 22 characters SHA-256 | 43 characters SHA-512 | 86 characters
The characters in "salt" and "encrypted" are drawn from the set
[a-zA-Z0-9./]. In the MD5 and SHA implementations the entire key is significant (instead of only the first 8 bytes in DES).