Shadow Utilities
If you are in a multiuser environment and not using a networked authentication scheme such as Kerberos, you should consider using Shadow Utilities (also known as shadow passwords) for the enhanced protection offered for your system's authentication files. During the installation of Red Hat Linux, shadow password protection for your system is enabled by default, as are MD5 passwords (an alternative and arguably more secure method of encrypting passwords for storage on your system).
Shadow passwords offer a few distinct advantages over the previous standard of storing passwords on UNIX and Linux systems, including:
Improved system security by moving the encrypted passwords (normally found in /etc/passwd) to /etc/shadow which is readable only by root
Information concerning password aging (how long it has been since a password was last changed)
Control over how long a password can remain unchanged before the user is required to change it
The ability to use the /etc/login.defs file to enforce a security policy, especially concerning password aging
The shadow-utils package contains a number of utilities that support:
Conversion from normal to shadow passwords and back (pwconv, pwunconv)
Verification of the password, group, and associated shadow files (pwck, grpck)
Industry-standard methods of adding, deleting and modifying user accounts (useradd, usermod, and userdel)
Industry-standard methods of adding, deleting, and modifying user groups (groupadd, groupmod, and groupdel)
Industry-standard method of administering the /etc/group file using gpasswd
 | Note |
|---|---|
There are some additional points of interest concerning these utilities:
|