Take the 2-minute tour ×

I'm playing with a rather old, heavily customized Linux installation (based on Debian etch, running on a Netgear ReadyNAS device).

Recently I've switched from /etc/passwd to /etc/shadow via pwconv.

Now I'd like to switch back due to authentication problems with the Apache server, because mod_auth_shadow is not installed and I'm hesitant to install it.

As an additional complication: pwunconv does not exist either.

I have a backup, but it's old and I have been installing a lot of packages since it was taken. I also have the option of doing a factory reset, but that will mean I lose the RAID configuration which I do not want.

What steps would I need to take to go back to regular passwd-based password authentication rather than shadow passwords?

share|improve this question
Have a look in /etc/pam and friends. Chances are there's a call to the shadow password authentication module there that might need to be replaced. –  Michael Kjörling Nov 11 '13 at 10:02
Are we to assume that you don't have a useful backup to restore from, or are you just wondering which files to restore? –  Michael Kjörling Nov 11 '13 at 10:02
@Michael I do have a backup, albeit an older one, made at the time before I started installing all kinds of libs and packages. There also is the option of factory-resetting the box, but that's scary because I would lose the RAID. I prefer poking the right files, but currently I lack the necessary understanding. –  Tomalak Nov 11 '13 at 10:18

2 Answers 2

up vote 2 down vote accepted

The pwconv command automagically backups the /etc/passwd in a file called /etc/passwd-.

Try to restore this file and rename /etc/shadow to /etc/shadow-.

share|improve this answer
You mean passwd and passwd-? Yes, that file exists. But how do I configure the system to stop using shadow? –  Tomalak Nov 11 '13 at 9:11
@Tomalak, remove or rename it. –  Stéphane Chazelas Nov 11 '13 at 13:04
Okay, sounds reasonable enough, I just wanted a confirmation. I'll try and report back. –  Tomalak Nov 11 '13 at 13:20
I've renamed /etc/shadow to /etc/shadow_ and /etc/passwd- to /etc/passwd. So far this had no ill-effects, I can still log in normally. (Apache still does not let me in though, apparently that's a disconnected problem.) –  Tomalak Nov 13 '13 at 7:28

Instead of going back manually you could try if you have the apache PAM authentication module available "libapache2-mod-auth-pam" as a distribution supported package.

I have no test boxes that old but the pam_unix module supports both shadow and regular passwd, so I would think that merging the encrypted passwords back into your etc/passwd file and renaming the /etc/shadow* files should be sufficient. You may need to add the option broken_shadow to pam configuration files in /etc/pam.d/* referencing the pam_unix module.

share|improve this answer
Yes, I've tried installing that module (apt-get), but for some reason it wouldn't install. I did not want to break apache by meddling with it unless I also had a way to back out. I'll try merging/renaming as soon as I understand what makes the system use shadow in the first place. –  Tomalak Nov 11 '13 at 10:13
It's a single user system anyway, so having all stuff in /etc/passwd is not a real drawback. I'm also hesitant of changing stuff in /etc/pam.d for fear shutting myself out of the system. I have set up ssh with public key authentication, is there a chance that changing pam_unix options breaks this? –  Tomalak Nov 11 '13 at 10:14
Changing pam settings typically doesn't break existing sessions... –  HBruijn Nov 11 '13 at 10:20
Now that I know I can easily switch between shadow and passwd I can try to make authentication work in apache. –  Tomalak Nov 13 '13 at 7:31

Your Answer


