Lesson 3.2: How systems store passwords
A system has to check your password without keeping it. How Linux does it in /etc/shadow, what the fields and the $id$ prefixes mean (yescrypt, SHA-512 crypt, locked accounts), why every password gets its own salt and why password hashes are deliberately slow, and how a web application does the same with PHP's password_hash and password_verify. In the lab you read the shadow file safely with sudo, find an old account still using a legacy method and one that's locked, check which method new passwords get, and hash and verify a password in PHP.
17 min
You will learn to
- Explain why systems store password hashes, not passwords
- Read /etc/shadow fields and $id$ prefixes
- Explain salts and slow password hashing
- Find accounts with legacy hashes or locked passwords
- Use password_hash and password_verify
Key terms
- /etc/shadow
- The Linux file that holds password hashes and ageing information, readable only by root.
- Salt
- A random value stored with each password hash and mixed into it, so equal passwords get different hashes.
- Password hashing function
- A deliberately slow, salted hash with an adjustable cost, built for passwords.
- Cost factor
- A parameter that sets how much work each hash takes; raised over time as hardware gets faster.
- Modular crypt format
- The $id$params$salt$hash layout that tells software which method made a hash.
← Storing and checking passwords · All lessons · Security controls: preventive, detective, corrective →