How does /etc/shadow enhance security?

The /etc/shadow file enhances security in several ways:

1. Restricted Access: Unlike the /etc/passwd file, which is readable by all users, the /etc/shadow file has restricted permissions, typically allowing only the root user to access it. This prevents unauthorized users from viewing sensitive password hashes.

2. Password Hashing: Passwords are stored as hashes rather than in plain text. Even if an attacker gains access to the file, they cannot easily retrieve the original passwords, as hashing is a one-way function.

3. Password Expiration: The /etc/shadow file can store information about password expiration and aging. This allows system administrators to enforce policies that require users to change their passwords regularly, reducing the risk of compromised accounts.

4. Account Locking: It can indicate whether an account is locked or disabled, preventing unauthorized access to accounts that should not be used.

5. Separation of Concerns: By separating password information from user account details in /etc/passwd, it minimizes the risk of exposing sensitive data through less secure means.

Overall, these features contribute to a more secure user authentication system, protecting against unauthorized access and potential breaches.