Passwords and /etc/shadow

/etc/shadow

The password hashes are in /etc/shadow. Unlike /etc/passwd, normal users can't read it: it belongs to root and the shadow group, which a few login programs use. Compare the permissions:

ls -l /etc/passwd /etc/shadow
sudo grep -E '^(root|student):' /etc/shadow

In the terminal

student@vulntech:~$ ls -l /etc/passwd /etc/shadow
-rw-r--r-- 1 root root   802 Oct 17 05:31 /etc/passwd
-rw-r----- 1 root shadow 422 Oct 17 05:31 /etc/shadow
student@vulntech:~$ sudo grep -E '^(root|student):' /etc/shadow
[sudo] password for student:
root:!*::0:::::
student:$6$SwwaIWoXFjlEjEz7$IF2Uww3gCqDM6rYS0bJ/21DZ82.wZtwJsXlVwWMeyW1W/vXH2GVjQVJcEnN/aDG6c6p/CbN8906wZlgESFdhu0:20743:0:99999:7:::

The second field is not the password itself but a hash: a scrambled fingerprint of it. When you log in, Linux hashes what you type and compares the two. The $6$ at the start says which method was used (SHA-512); the part between the next $ signs is a random salt, so two users with the same password still get different hashes.

root is locked on this machine, just like on Ubuntu: you get root's powers through sudo instead.

Changing your own password: passwd

passwd asks for your current password, then the new one twice. Nothing shows while you type. (On this practice machine, Reset sets it back to student.)

passwd

In the terminal

student@vulntech:~$ passwd
Changing password for student.
Current password:
New password:
Retype new password:
passwd: password updated successfully

Other people's passwords

As root, passwd followed by a user name sets that user's password without asking for the old one. Here, Alice forgot hers:

sudo passwd alice

In the terminal

student@vulntech:~$ sudo passwd alice
[sudo] password for student:
New password:
Retype new password:
passwd: password updated successfully

Locking an account

passwd -l locks an account (it puts a ! in front of the hash) and passwd -u unlocks it. -S shows the status (L = locked, P = usable password):

sudo passwd -l alice
sudo passwd -S alice
sudo passwd -u alice
sudo passwd -S alice

In the terminal

student@vulntech:~$ sudo passwd -l alice
[sudo] password for student:
passwd: password changed.
student@vulntech:~$ sudo passwd -S alice
alice L 2026-10-17 -1 -1 -1 -1
student@vulntech:~$ sudo passwd -u alice
passwd: password changed.
student@vulntech:~$ sudo passwd -S alice
alice P 2026-10-17 -1 -1 -1 -1

Tip: sudo chage -l user shows when a password was last changed and when it expires. Companies use chage to force regular password changes.

Remember: Hashes are in /etc/shadow (root only). passwd changes yours, sudo passwd user sets someone else's, -l/-u lock and unlock.