Which file is described as not containing the passwords themselves?

Which file is described as not containing the passwords themselves?

• A. Shadow file
• B. /etc/passwd
• C. Pwdump
• D. Botnet Trojans

Answer: (B)

Separating account information from password data is a security design. The file that holds user account metadata—such as usernames, UID, GID, home directory, and login shell—does not store the actual passwords. On modern systems, the password hashes (not the plaintext passwords) are kept in a separate, restricted file, while the account information file contains a placeholder in the password field. Because of this separation, the file with the user account data is not containing the passwords themselves, making it the correct choice here. Historically, /etc/passwd could include the encrypted password in the second field, but to boost security, the hashes were moved to /etc/shadow. The shadow file then contains the password hashes and aging information, accessible only to root. The other option listed—being a tool that dumps password hashes from Windows—does not describe a file at all, and the remaining option refers to malware rather than a password storage file.

Separating account information from password data is a security design. The file that holds user account metadata—such as usernames, UID, GID, home directory, and login shell—does not store the actual passwords. On modern systems, the password hashes (not the plaintext passwords) are kept in a separate, restricted file, while the account information file contains a placeholder in the password field. Because of this separation, the file with the user account data is not containing the passwords themselves, making it the correct choice here.

Historically, /etc/passwd could include the encrypted password in the second field, but to boost security, the hashes were moved to /etc/shadow. The shadow file then contains the password hashes and aging information, accessible only to root. The other option listed—being a tool that dumps password hashes from Windows—does not describe a file at all, and the remaining option refers to malware rather than a password storage file.