Concept - Password File Access Control

• Can block offline guessing attacks by denying access to the encrypted passwords: make them available only to privileged users, often using a separate shadow password file, where hashed passwords are kept in a separate file from the user IDs (s.19).
• Still vulnerable (s.19): exploiting an O/S bug; an accident with permissions making the file readable; users with the same password on other systems; access from unprotected backup media; sniffing passwords in unprotected network traffic.

Exam tip: “shadow password” = hashes in a separate, privileged-only file.

Related: Concept - Password Hashing and Salt, Concept - Password Vulnerabilities and Countermeasures, Concept - Access Control. Appears in 03 User Authentication - Chunk 01 (s.1-33).