Now the very cool thing is that we can go out to our command
line now and start examining our shadow data by taking a
look at the shadow file itself.
We can even take a look at the man pages should we so desire,
as well as being able to take a look at the chage command so we can
understand some of these settings just a little bit better.
Now remember, I'm logged on as the root user,
but if I exit out of my sudo shell, I'm back of course as a standard user.
If I try and cat out the etc and shadow file,
then we're going to find out that I don't have permissions to it,
unlike the passwd file where I would have access.
Now because the passwd file is world readable,
I could easily make a copy of that,
and should our user passwords be stored in there,
I could take as long as I want, undetected,
to be able to try and brute force some of those passwords.
So there are important reasons why we have our shadow file kept separately.
It's only accessible to root.
I could also try and access it using the getent command,
but this time I'm going to use the shadow,
so I go to my Shadow database.
Again, my shadow database might be looking at the /etc/shadow file,
but equally could be looking at my active directory,
or looking at some form of LDAP server.
So remember what we say about the getent command,
it is able to go through and delve into all of our identity sources.
If I then go through and hit Enter, now I don't get any errors,
so perhaps I might not realize that I've got permissions issues,
but of course I still don't list that information.
Whereas if I do sudo,
and don't forget about the shortcut!!, which
completely replicates the previous command,
all options, and arguments, now of course I'm just running it with sudo in front,
then I'm able to see everything.
If I look at it, let's say,
just for one user where I go through and maybe look at the vagrant user account,
we can see with that then we've got the username vagrant,
the second field is my encrypted password.
But again, don't worry about that.
We'll see more information on the encrypted password and what it actually means,
later.
We're then into the rest of the shadow data.
Now again, I can explain field by field,
but if I go through and take a look at man and 5 and take a look,
then, at our shadow file, so our etc and shadow,
then each line is represented by fields,
and we see the login name, encrypted password,
date of last password change, etc.
So it's all documented inside of your shadow man page.
We could also see it, though,
if I go through and look at chage ‑l for my user account,
so I'm just going to put in vagrant.
We could use like $user the variable, such as I had in the slide.
Now thankfully we can see the information that's really well annotated,
so we can see things like our last password change,
and we've never set it.
Using Vagrant we can authenticate using SSH keys,
so a lot of this shadow information becomes less important
because it's to do with managing our user password.
But at least we can see the annotation of the information here matching
up to the data that we could see within our man page,
as well as the raw shadow data itself.
So I really like the idea of this chage ‑l command just to
get some interpretation of our shadow data.
But to be able to understand it in a little bit more,
why don't we go through and set our password?
I'm going to set it using sudo.
The idea of me using sudo and the passwd command is that I'm
able to set a very simple password this way.
It does a dictionary check, and it doesn't care,
because I'm root, that I could set a simple password.
As we can see, it does warn me that we're failing the complexity check; however,
it does allow the root user to set a simple password.
So, again, simplicity works for me.
But if we go through now and take a look,
we can see that the password was last changed on today's date.
But if we go through and take a look at this from the raw shadow data,
it will look a little bit more difficult to understand.
And I want to show you it's not that difficult to understand.
As I look at it, the password has changed 19,079 days after the 1st of January,
1970.
And you're going to say, well, goodness me.
But the reality is, all dates are some form of offset to an epoch.
Well, it's so easy for us to resolve this.
If I go through using the date command and then specify 19079 days ago,
because we've changed our password today,
we're able then to go through and see that this does
relate to the 1st of January in 1970.
So quite cool.
We're looking at some fantastic things that we're able to do using the date command, as well as understanding our shadow data.