/etc/shadow is an access-restricted ASCII system file that stores users' encrypted passwords and related information. The shadow file can be used in conjunction with other shadow sources, including the NIS maps passwd.byname and passwd.byuid and the NIS+ table passwd. Programs use the getspnam(3C) routines to access this information.
The fields for each user entry are separated by colons. Each user is separated from the next by a newline. Unlike the /etc/passwd file, /etc/shadow does not have general read permission.
username:password:lastchg: min:max:warn: inactive:expire:flag
The user's login name (UID).
An encrypted password for the user generated by crypt(3C), a lock string to indicate that the login is not accessible, or no string, which shows that there is no password for the login.
The lock string is defined as *LK* in the first four characters of the password field.
The number of days between January 1, 1970, and the date that the password was last modified.
The minimum number of days required between password changes.
The maximum number of days the password is valid.
The number of days before password expires that the user is warned.
The number of days of inactivity allowed for that user. This is counted on a per-machine basis; the information about the last login is taken from the machine's lastlog file.
An absolute date specifying when the login may no longer be used.
Reserved for future use, set to zero. Currently not used.
In order to make system administration manageable, /etc/shadow entries should appear in exactly the same order as /etc/passwd entries; this includes ``+'' and ``-'' entries if the compat source is being used (see nsswitch.conf(4)).
shadow password file
name-service switch configuration file
time of last login
If password aging is turned on in any name service the passwd: line in the /etc/nsswitch.conf file must have a format specified in the nsswitch.conf(4) man page.
If the /etc/nsswitch.conf passwd policy is not in one of the supported formats, logins will not be allowed upon password expiration because the software does not know how to handle password updates under these conditions. See nsswitch.conf(4) for additional information.