Where is the shadowed passwdfile?

[jollewhoever]

This is not for "hacking" purpouses... Im exporing my X with terminal and in the /private/etc there is the passwd file. Of course it is shadowed... So i wonder, where lies the shadow file, or the real passwd...

 

[scruffy]

Actually /etc/passwd isn't used except for single user boot. The passwords are kept in the Netinfo database
niutil -read . /users/username
will get you the info in Netinfo format. If you want to see things in passwd format:
nidump passwd .
should do the trick. Notice that you can get that even if you're not root... I call that a bug, but what do I know?

 

[lethe]

yeah, passwords are not shadowed. it is not a bug, but it is certainly a security flaw.


bug means error in coding. this isn t an error, it is just an omission of a feature.

another command to try is

nidump passwd .

it shows the netinfo passwd info formatted just like a passwd file.

 

[jollewhoever]

Wow, that means that macosx isn't so secure, but it depends on what password you chose..
Is it a DES encryption?

 

[blb]

Originally posted by jollewhoever
Wow, that means that macosx isn't so secure, but it depends on what password you chose..
Is it a DES encryption?

Yeah, it's using the classic Unix-style password encryption (DES with the password itself as a key, plus a two character salt).
Be sure if anyone else has local access to your machine and you don't completely trust them, to use a good password...