easyMultiple Choice
How to Fix Insecure /etc/shadow Permissions (chmod 600)
A security audit reveals that the /etc/shadow file has permissions 777. Which command should be used to correct this vulnerability?
Quick Answer
The correct command is `chmod 600 /etc/shadow`, which sets read and write permissions exclusively for the root owner while stripping all access from group and others. This is essential because the /etc/shadow file stores hashed user passwords, and permissions 777 would allow any user on the system to read, modify, or even execute the file, creating a critical security vulnerability that exposes password hashes to brute-force attacks. On the CompTIA Linux+ XK0-005 exam, this scenario tests your understanding of Linux file permissions and the principle of least privilege, often appearing as a straightforward fix for a security audit finding. A common trap is confusing this with `chmod 644`, which would still allow group or others to read the file—remember, shadow must be root-only. A useful memory tip: think of "600" as "six-zero-zero" meaning "only the owner (root) gets the key (read/write), and everyone else gets zero access."
⚠ Common exam trap
It's easy for candidates to confuse the required permissions for /etc/shadow with those for /etc/passwd (which is 644), leading them to choose 644 or 640 instead of the more restrictive 600.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
chmod 600 /etc/shadow
The /etc/shadow file stores hashed user passwords and must be readable only by root to prevent unauthorized access. Permissions 777 allow any user to read, write, and execute the file, which is a critical security vulnerability. The correct command is `chmod 600 /etc/shadow`, which sets read and write permissions for the owner (root) only, denying all access to group and others.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
chmod 660 /etc/shadow
Why it's wrong here
Mode 660 grants read and write to the shadow group, letting group members modify password hashes. It is tempting because 660 removes all access for other, which looks sufficiently restrictive. /etc/shadow requires 000 or 640, with write access reserved for root alone.
- ✓
chmod 600 /etc/shadow
Why this is correct
chmod 600 grants read and write only to root, removing world and group access that 777 permits. This satisfies the audit requirement by restricting /etc/shadow to its owner, preventing unprivileged users from reading password hashes.
- ✗
chmod 644 /etc/shadow
Why it's wrong here
Mode 644 grants read access to group and other, exposing password hashes to every local account. It is tempting because 644 is the standard permission for ordinary readable configuration files. /etc/shadow must be 000 or 640, readable only by root and the shadow group.
- ✗
chmod 640 /etc/shadow
Why it's wrong here
Mode 640 grants read access to the shadow group, permitting members to view password hashes they should not see. It is tempting because 640 is the conventional permission for sensitive root-owned configuration files. /etc/shadow should be 000 or 640 only where the shadow group legitimately requires read access; on most systems 000 is expected.
Go deeper
Related to this question
Learn chapter
File Permissions and Ownership
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
chmod
chmod is a command in Linux and Unix-like operating systems used to change the permissions (read, write, execute) of a file or directory.
About these practice questions
This XK0-006 question is part of Courseiva's 781-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on XK0-006
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security audit reveals that a server's /etc/shadow file is readable by all users. Which command would correctly fix the permissions?
hard- A.chmod 644 /etc/shadow
- ✓ B.chmod 600 /etc/shadow
- C.chmod 640 /etc/shadow
- D.chmod 640 /etc/shadow && chown root:shadow
Why B: The /etc/shadow file stores password hashes and must be readable only by root, so the correct permission is 600 (rw-------) owned by root. 'chmod 600 /etc/shadow' removes all group and other permissions, preventing unprivileged users from reading hashed credentials while still allowing root to read and write the file.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.