pwconv tips — authorized shadow-convert literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may run pwconv on the lab host (syllabus box you own or were given access to).
2. Prefer documenting who / why / ticket before any convert — never reshape production password databases without change control.
3. Record short factual notes; quote short Evidence (whether shadow appeared / passwd password field became x — never hashes).
4. Optional: reverse convert → pwunconv-tips.
5. Optional: interactive edit → vipw-tips; sanity → pwck-tips.
6. Prefer disposable lab images for convert drills; quote getent / file presence afterward as Evidence.
7. Prefer backing up lab-only copies the syllabus allows — never exfiltrate real shadow files.
8. Stop at literacy — no attack or unauthorized convert cookbooks.

Allowed framing

• Classroom labs reviewing pwconv on authorized disposable images that start without shadow.
• Binding short factual notes as Evidence (convert intent + resulting file presence — no hashes).
• Documenting expected vs observed shadow presence for authorized inventory notes.
• Comparing pwconv ↔ pwunconv / vipw / pwck peer tip pages under one binder.
• Testing idempotent re-runs when the syllabus authorizes that drill.

Scope we will not cover

• No crack/pirate/keygen via pwconv.
• No intentional unauthorized shadow converts against foreign hosts.
• No secret-theft or hash harvesting against hosts you do not own.
• No cookbooks that weaken password storage as an attack step without authorization.

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab image where the instructor authorizes a convert drill.
2. Document whether /etc/shadow is already present before running anything.
3. With authorization, run pwconv; quote non-secret Evidence (shadow presence; passwd field shows x).
4. Optional: reverse with pwunconv-tips; sanity with pwck-tips.
5. Stop at literacy — no attack or unauthorized convert cookbooks.

Practical notes for authorized labs

• Modern distros already use shadow — many drills are idempotent; quote that honestly.
• Pair with grpconv-tips when the syllabus covers group→gshadow in the same lab.
• Never paste before/after hash material into binders or git.
• Prefer lab snapshots so converts are reversible without touching production.
• Label lab-only converts clearly so they are not mistaken for production posture.
• pwck after convert is a useful sanity peer — keep Evidence labels distinct.

FAQ-aligned refusals (quick)

• Foreign-host shadow converts → refuse.
• Unauthorized hash-exfil cookbooks → refuse.
• Attack/credential-theft framing → refuse.

For legal, authorized and educational use only.

FAQ

Sources