The release of the shadow-utils toolkit 4.19.0 is available, which includes utilities for managing user and group credentials, as well as storing passwords in a separate file /etc/shadow, accessible only to the root user and the shadow group. It includes utilities such as useradd, userdel, usermod, pwconv, groupadd, groupdel, groupmod, pwunconv, pwck, lastlog, su, and login. The code for the toolkit is written in C and distributed under the BSD license.
The new version notably announces deprecated functionality, forcing users to change their passwords after a certain period. Recent studies have shown that the security gain from periodic password changes is minimal, and forcing password changes leads to users employing predictable patterns. The NIST SP 800-63B-4 standard approved in 2025 does not recommend limiting password lifetime. The deprecated options include '-k' (—keep-tokens), '-n' (—mindays), '-x' (—maxdays), '-i' (—inactive), and '-w' (—warndays), as well as the flags PASS_MIN_DAYS, PASS_MAX_DAYS, PASS_WARN_AGE, INACTIVE, sp_lstchg, sp_min, sp_max, sp_warn, and sp_inact. There are currently no plans to remove these options and flags; the discussion only pertains to marking them as deprecated.
Other significant changes in the new version include:
- The use of escaped newline characters in configuration files is prohibited.
- Support for SHA-1 hashes has been declared deprecated, and in the next release, the option ‘—with-sha-crypt’ will be removed.
- The utilities groupmems and logoutd have been categorized as deprecated and are planned for removal in future releases.
- Blocking the use of certain dangerous usernames and group names has been implemented, regardless of the state of the ‘—badname’ option. For example, names that start with ‘-’ or contain special characters such as ‘#:;,/’ and various forms of quotes are restricted.
Source: opennet.ru
