Where is the username and password stored?

Question

Just for my curiosity, where is the username and associated password stored in Ubuntu? And how it is verified at the login time?

Solution

Passwords can be found (in hashed form) in /etc/shadow and the users in /etc/passwd.

The login program is used to establish a new session with the system. It is normally invoked automatically by responding to the login: prompt on the user´s terminal. login may be special to the shell and may not be invoked as a sub-process. Typically, login is treated by the shell as exec login which causes the user to exit from the current shell. Attempting to execute login from any shell but the login shell will produce an error message.

   The user is then prompted for a password, where appropriate. Echoing is
   disabled to prevent revealing the password. Only a small number of
   password failures are permitted before login exits and the
   communications link is severed.

   If password aging has been enabled for your account, you may be
   prompted for a new password before proceeding. You will be forced to
   provide your old password and the new password before continuing.
   Please refer to passwd(1) for more information.

More info at: http://manpages.ubuntu.com/manpages/hardy/man1/login.1.html

http://manpages.ubuntu.com/manpages/hardy/man5/passwd.5.html

Comments

[Tachyons]

Stored in hashed form ,what is it means

[Oli]

@tachyons It's a one-way conversion; a method of digesting a message and returning a near-unique string so you never have to store the original password (huge security risk). When you want to challenge a password you just subject it to the same hashing algorithm and if the hashes match, the passwords are 99.9999999% likely to be the same. en.wikipedia.org/wiki/Cryptographic_hash_function

[Tachyons]

Thanks I googled it and got many usefull links,it is really interesting :)