‫In Linux systems, the ETSI Shadow file stores actual passwords in encrypted format, more like the
‫hash of the password for users account with additional properties related to the user password.
‫Basically, it stores secure user account information.
‫All fields are separated by colon symbol.
‫And it contains one entry per line for each user listed in the Etsy password file.
‫Generally, shadow file entry looks as seen in the slide.
‫So let's see the fields of a typical Linux hash values most probably gathered from the shadow file.
‫Just like in windows, local hashes, fields are separated by colons in the Linux hashes.
‫The first field is username, your log, your name, the second field is your encrypted password.
‫Usually, the password format is set to dollar ID $ $80 hash.
‫The ID is the algorithm used on going to Linux as follows.
‫Dollar one dollar is MD5.
‫Dollar to a dollar is blowfish.
‫Dollar to why dollar is blowfish.
‫Dollar five S. Dollar is a 256 dollar, $6, is 512.
‫Now, the third field is the date that the password was last modified.
‫The fourth field is the minimum number of days required between password changes.
‫That is, the number of days left before the user is allowed to change his or her password.
‫The fifth field is the maximum number of days a password is valid.
‫After that, the user is forced to change his or her password.
‫The sixth field is the number of days before the password is to expire, that user is warned that his
‫or her password must be changed.
‫Now there are two more fields in the line which are blank in this example.
‫The seventh field is called inactive, which is the number of days after password expires that the account
‫is disabled.
‫And the last field is called expire, which indicates the days since one January 1970 that the account
‫is disabled.
‫That is an absolute date, specifying when the log in may no longer be used.