Cracking the Code: Password Attacks & the Linux Authentication Process

By Nadim Shah Momin June 12, 2025 Cybersecurity | Linux | Ethical Hacking

In the world of Linux and cybersecurity, understanding how password storage and authentication work isn’t just helpful — it’s critical. Whether you’re an ethical hacker, system admin, or just diving into infosec, this knowledge lays the groundwork for securing systems or spotting misconfigurations.

In this post, we’ll unpack the Linux authentication process, explore how credentials are managed, and finally walk through how password attacks are executed in practice.

🔐 How Linux Handles Authentication

Modern Linux distributions use PAM — Pluggable Authentication Modules — to manage authentication. These are modular, pluggable components that define how users are authenticated, how sessions are managed, and how passwords are updated.

Two common PAM modules are: — pam_unix.so — pam_unix2.so

These are typically found in /usr/lib/x86_64-linux-gnu/security/ on Debian-based systems. When you run the passwd command to change a password, PAM is triggered under the hood to securely update relevant files and apply system-wide policies.

📁 Meet the /etc/passwd File

One of the most iconic files in any Linux system is /etc/passwd. Despite its name, it doesn’t usually store actual passwords anymore. It contains important information about all user accounts.

A typical entry looks like this: htb-student:x:1000:1000:,,,:/home/htb-student:/bin/bash

Field meanings: — Username: htb-student — Password: x (real password is in /etc/shadow) — UID: 1000 — GID: 1000 — GECOS: ,,, — Home Directory: /home/htb-student — Shell: /bin/bash

In older systems, password hashes might be stored directly here. Today, the ‘x’ signifies they’re in /etc/shadow.

🧱 The Real Fortress: /etc/shadow

The /etc/shadow file securely stores password hashes and is only readable by root. Example entry: htb-student:$y$j9T$3QSBB6CbHEu…SNIP…f8Ms:18955:0:99999:7:::

Structure: — Username — Password hash: $id$salt$hashed — Last changed: Days since Jan 1, 1970 — Min/Max age — Warning/Expiry

Hash ID values: — 1: MD5 — 5: SHA-256 — 6: SHA-512 — y: Yescrypt (modern default) — 7: Scrypt

‘!’ or ‘*’ in hash field = login disabled. Empty field = no password needed.

🔁 Preventing Password Reuse: /etc/security/opasswd

To stop users from recycling old passwords, Linux uses /etc/security/opasswd, managed by pam_unix.so. It stores historical hashes for each user, separated by commas.

Example: cry0l1t3:1000:2:$1$HjFA…,$1$kcUj…

MD5 hashes here are weaker and easier to crack. Reuse patterns may be discovered.

💥 Cracking Linux Credentials: From Theory to Practice

With root access, password cracking is straightforward. Steps:

1. Backup passwd and shadow: sudo cp /etc/passwd /tmp/passwd.bak sudo cp /etc/shadow /tmp/shadow.bak

2. Generate unified file: unshadow /tmp/passwd.bak /tmp/shadow.bak > /tmp/unshadowed.hashes

3. Crack with Hashcat: hashcat -m 1800 -a 0 /tmp/unshadowed.hashes rockyou.txt -o /tmp/unshadowed.cracked

Or use John the Ripper’s single crack mode for faster results.

⚠️ Common Security Gaps to Watch

• World-readable /etc/passwd is normal; world-writable is dangerous — Shadow entries must match passwd entries — Misconfigured /etc/ permissions = critical risk — Weak hashes like MD5 = easy target

🧠 Final Thoughts

Understanding Linux authentication mechanisms helps you secure systems, detect misconfigurations, and identify potential attack vectors. Whether you’re a blue teamer hardening your systems or a red teamer simulating an intrusion, these basics are a must-have in your toolkit.

🔍 Always audit your /etc/passwd, /etc/shadow, and PAM configurations regularly.

👣 Because sometimes, all it takes is one misstep to leave the door wide open.

Liked this post? Visit: https://nadzz.info for more insights into cybersecurity, Linux, and real-world hacking tactics.