Keep local password hashes and aging data unreadable by ordinary users using the standard shadow-password arrangement.
Which configuration is appropriate?
/etc/shadow stores password hashes and aging data, so ownership and permissions should restrict it to root and other required privileged subjects.
Detailed explanation
Incorrect. Ordinary users normally need to read account metadata in /etc/passwd.
Incorrect. Ordinary users normally need to read account metadata in /etc/passwd.
Correct. It restricts direct access to password hashes.
Correct. It restricts direct access to password hashes.
Incorrect. World-readable hashes enable offline password attacks.
Incorrect. World-readable hashes enable offline password attacks.
Incorrect. /etc/services stores service and port mappings.
Incorrect. /etc/services stores service and port mappings.
Try it yourself
An example you can run in a temporary verification environment.
printf '%s
' '/etc/passwd=public account metadata' '/etc/shadow=restricted hashes and aging'Expected result
/etc/passwd=public account metadata
/etc/shadow=restricted hashes and agingKey points
- Keep hashes private
- passwd remains lookup-readable
- Audit shadow ownership and permissions
Notes
- Environment: file役割対応表
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.