How is /etc/shadow secured?

The /etc/shadow file is secured through several mechanisms:

1. File Permissions: The permissions on the /etc/shadow file are typically set to restrict access. For example, it is usually owned by the root user and the shadow group, with permissions set to 640 (-rw-r-----). This means that only the root user and members of the shadow group can read the file, while other users have no access.

2. Separation from /etc/passwd: Unlike the /etc/passwd file, which is world-readable, the /etc/shadow file is not accessible to regular users. This separation helps protect sensitive password hashes.

3. Access Control: Only privileged processes (like login services) can access the /etc/shadow file. This limits the exposure of password hashes to unauthorized users or processes.

4. Password Hashing: Passwords are stored as hashes rather than plain text. Even if an attacker gains access to the /etc/shadow file, they would only see hashed values, which are difficult to reverse-engineer.

5. Use of Strong Hashing Algorithms: Modern Linux systems use strong hashing algorithms (like SHA-512) to create password hashes, making it computationally expensive to crack them.

6. Account Lockout Policies: Many systems implement account lockout policies that can temporarily disable accounts after a certain number of failed login attempts, reducing the risk of brute-force attacks.

These security measures work together to protect the integrity and confidentiality of user passwords stored in the /etc/shadow file.