/etc/passwd and/etc/shadows in Linux

If a user on a Linux operating system needs to log on to the host, after entering the user name and password:

1. First in the/etc/passwd file to find out if you have an account, if not unable to log in, if any, the user's UID and GID read out, in addition to this user's shell settings are also read out.
2. Then according to the UID to the/etc/shadow file to find the corresponding user's password, if the match is consistent
3. Enter the shell control phase.

We explain these two files in detail below:

One:/etc/passwd

[Email protected]:~# cat/etc/passwdroot:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/ nologinbin:x:2:2:bin:/bin:/usr/sbin/nologinsys:x:3:3:sys:/dev:/usr/sbin/nologinsync:x:4:65534:sync:/bin:/bin/ Syncgames:x:5:60:games:/usr/games:/usr/sbin/nologinman:x:6:12:man:/var/cache/man:/usr/sbin/nologinlp:x:7:7:lp :/var/spool/lpd:/usr/sbin/nologintest:x:1000:1000::/home/test:/bin/sh

Fields are : separated from each other.

Field	meaning
1	User name
2	The user's password was originally stored directly in the second field, but for security purposes, the/etc/shadow file was specifically used and is now replaced with X by default
3	The UID of the user, in general the root is 0, 1-499 defaults to the system account, some are larger to 1000,500-65535 for the user's login account, some systems start from 1000.
4	User Gid,linux users will have two ID, a user uid, a user group ID, when we log in, enter the user name and password, in fact, will first go to/etc/passwd to see if you entered the account or user name, some words will the account with the corresponding UID and GID Read it (in/etc/group). Then read out the home folder and the shell settings, and then go to verify the password is correct, the correct words to log in correctly.
5	Explanation of User's account description
6	User's Home Directory folder
7	The shell used by the user, if replaced by/sbin/nologin/, is not the default login environment.

Two:/etc/shadow

[email protected]:~# cat/etc/shadowroot:$6$duij86er$ Qr8rjoj3wk0niignfxatv/hw5/198d8kivya.rjxvdwgzmrpsrvu4tcio0g/vrvvogy5ayokzivo9kfvignys1:17631:0:99999:7::: daemon:*:17557:0:99999:7:::bin:*:17557:0:99999:7:::sys:*:17557:0:99999:7:::sync:*:17557:0:99999:7:::games:* : 17557:0:99999:7:::man:*:17557:0:99999:7::: 

Field	meaning
1	User name
2	User's password encryption field
3	The date the password has been used (starting from 1970-01-01, why?) Because the unix1969 year release prototype, based on the system at the time of consideration, this is the case)
4	The password can be modified at least after a few days (in the example, after 3 days, that is, after 3 days of modification)
5	The password must be modified after a few days (in the example 99999 means that you can never change the password)
6	A few days before password modification remind me to modify (example is 7 days ago)
7	If the extension is not modified for a few days (example extension 3 days)
8	Regardless of how this time expires (the time in the example is calculated from 1970-01-01)
9	Reserved field, no meaning at present

Reprinted from: 50753906

/etc/passwd and/etc/shadows in Linux