Lesson 4.4: Changing passwords
How Linux stores passwords (hashes and salt in /etc/shadow, not the passwords themselves), changing your own and another user's password with passwd, account status, locking, and password ageing with chage.
15 min
You will learn to
- Explain hashing and salting and why only hashes are stored
- Read the fields of an /etc/shadow line
- Change passwords with passwd and check status with passwd -S
- Lock an account and set a maximum password age
Key terms
- Hash
- The output of a one-way function: easy to compute from a password, practically impossible to turn back into it. At login, the system hashes what you type and compares.
- Salt
- A random value stored with the hash and mixed into it, so two users with the same password get different hashes and precomputed tables don't work.
- /etc/shadow
- The file with password hashes and ageing data, readable only by root and the shadow group. Fields: name:hash:lastchange:min:max:warn:inactive:expire:
- Hash format $id$
- The prefix names the algorithm: $y$ yescrypt (Ubuntu's default since 22.04), $6$ SHA-512-crypt, $1$ MD5-crypt (obsolete). Then come the parameters, the salt and the hash.
- Locked account
- An account whose hash is prefixed with ! (or replaced by *), so no password can match.
- Password ageing
- Rules for how long a password may be used (max), how soon it may be changed again (min) and how many days of warning are given.
← Changing users: su and sudo · All lessons · Linux package management →