Thread: /etc/shadow changes?

hi there,

i've written script assist intrusion detection consists of md5 hashlist of sensitive/important files on system compared current md5sum of same files.
i'm testing , have come across md5 hash of /etc/shadow being different on every server testing on (it's run cron every 1am).

in situations /etc/shadow change?
under assumption stored password hashes, there other reason why md5sum of file alter other password being changed?

insight can provide.

posted richardm_ts

hi there,

i've written script assist intrusion detection consists of md5 hashlist of sensitive/important files on system compared current md5sum of same files.
i'm testing , have come across md5 hash of /etc/shadow being different on every server testing on (it's run cron every 1am).

in situations /etc/shadow change?
under assumption stored password hashes, there other reason why md5sum of file alter other password being changed?

insight can provide.

contents of each different based on users , passwords in file ?

or not understanding ?

/etc/shadow contents

1. user name : login name
2. password: encrypted password. password should minimum 6-8 characters long including special characters/digits
3. last password change (lastchanged): days since jan 1, 1970 password last changed
4. minimum: minimum number of days required between password changes i.e. number of days left before user allowed change his/her password
5. maximum: maximum number of days password valid (after user forced change his/her password)
6. warn : number of days before password expire user warned his/her password must changed
7. inactive : number of days after password expires account disabled
8. expire : days since jan 1, 1970 account disabled i.e. absolute date specifying when login may no longer used

Forum The Ubuntu Forum Community Ubuntu Specialised Support Ubuntu Servers, Cloud and Juju Server Platforms [ubuntu] /etc/shadow changes?

Ubuntu