User Authentication and Passwords

Users and groups form the backbone of security on a Linux system. Decisions about access to files, processes, and other resources generally begin by examining the user and group making the request. The most common method currently in use for a user to authenticate to a Linux system is by providing a password. Linux does not directly store passwords but rather stores password hashes. Security professionals need to know how these are calculated and where and how they are stored. Because of their importance, attackers try to steal these password hashes. The process of determining the password from a given password hash is called password cracking, and tools like John the Ripper are invaluable. Security professionals also need to know how Linux authenticates users to the system. This is a highly configurable process that uses pluggable authentication modules (PAM). These can be customized, either by a defender to improve their security posture or by an attacker that has compromised their target to enable persistent access.