Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On my Ubuntu 9.10 system, there's a shadow system group. There does not appear to be any user assigned to this group at all. The only files that I can find belonging to this group are /etc/shadow and /etc/gshadow.

I'm aware that the purpose of these files is to store the passwords separately, out of reach from regular users who still might want to access passwd for other reasons.

But what is the purpose of the shadow group?

The reason I'm curious about this, is because I'm thinking about configuring nsswitch.conf to store it elsewhere, and would like to know if anything is actually trying to access the shadow database using shadow group credentials.

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted
$ find /usr/bin/ -group shadow | xargs ls -l
-rwxr-sr-x 1 root shadow 45384 2008-12-08 03:13 /usr/bin/chage
-rwxr-sr-x 1 root shadow 21424 2008-12-08 03:13 /usr/bin/expiry

There may not be any users, but there is certainly software that needs to be able to read that file. Note that passwd itself is setuid root, and so doesn't need this.

share|improve this answer
add comment

No, shadow group should have no users, but this group is required for shadow passwords to work.

I guess the idea here is to have the file accessible by root and root only. You may have extra users in root group, this is why the separate user group was created.

share|improve this answer
1  
Do you have a reference to some kind of documentation that talks about that requirement? –  Zoredache Apr 16 '10 at 21:01
    
Hm... linux.org/docs/ldp/howto/Shadow-Password-HOWTO-5.html says "None of the users on the system should actually be in the shadow group." Also help.ubuntu.com/community/FilePermissions "Some files are configured to have very restrictive permissions to prevent unauthorized access. For example, the /etc/shadow file (file that stores all local user passwords) does not have permissions for regular users to read or otherwise access." I guess you could change the group to anything you want, but the shadow group is what is have been historically –  solefald Apr 16 '10 at 21:07
    
As long as the group permissions on that file are set to 0, and it's owned by root, I think it doesn't matter? But they're set to 'r' for the group. Why? –  Chris Lercher Apr 16 '10 at 21:12
    
@chris_l: see my answer –  Novelocrat Apr 16 '10 at 22:50
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.