[Tyler McAdams]

In traditional unix it's etc/shadow.... where is it in OS X? thx

[Millennium]

Normally they're kept in the NetInfo database. You can use nidump to generate a traditional /etc/passwd file (I don't know about /etc/shadow; OSX may not allow you to do that one). OSX doesn't use the traditional files, though, except as a last resort.

[Jellytussle]

Originally posted by Millennium:
Normally they're kept in the NetInfo database. You can use nidump to generate a traditional /etc/passwd file (I don't know about /etc/shadow; OSX may not allow you to do that one). OSX doesn't use the traditional files, though, except as a last resort.

Since 10.3, X uses a shadowed hash for local users, not NetInfo. look in /var/db/shadow/hash.

[Tyler McAdams]

Originally posted by Jellytussle:
Since 10.3, X uses a shadowed hash for local users, not NetInfo. look in /var/db/shadow/hash.

Thanks... are there any tools out there to recover these hashes? Similar to say LoftCrack? (Windows password hash cracker for those who don't know what I'm talking about)