GSHADOW(5)

💖 GSHADOW — the shadowed group file 💖

okay so bestie, we're talking about gshadow(5) — the shadowed group file, the mysterious sequel to /etc/group that nobody talks about at parties but everyone lowkey depends on. 👑

---

✨ NAME ✨

gshadow — the shadowed group file. yes it's giving secretive. it's supposed to. 🕵️♀️💅

---

🌸 DESCRIPTION 🌸

/etc/gshadow is where the shadowed information for group accounts lives. it's the backstage area of your group setup — the stuff that doesn't go in the public-facing /etc/group. 🎀

no cap: this file must not be readable by regular users if password security is to be maintained. like, genuinely. lock it down. 🔒

each line of this file is one group, and each line is made of fields separated by colons (:). here's the lineup, in order:

• group name — has to be a valid group name, and it has to actually exist on the system. no making up little fictional groups, bestie. ✨
• encrypted password — go read crypt(3) if you wanna know exactly how this string gets interpreted. it's giving cryptic for a reason.

if the password field has some string that is not a valid result of crypt(3) — for example ! or * — then users will not be able to use a unix password to access the group. (but the group members don't need the password anyway, so it's fine. 😌)

the password is used when a user who is not a member of the group wants to gain the permissions of that group. see newgrp(1) for the whole situation. 🔥

this field can be empty, and in that case only the group members can gain the group permissions. that's it. that's the whole guest list.

if the password field starts with an exclamation mark, that means the password is locked. and the remaining characters on the line represent the password field before the password was locked — so the history is still there, just, y'know, deactivated. 💀

this password supersedes any password specified in /etc/group. so if the two files disagree, gshadow wins. main character energy, honestly.

• administrators — has to be a comma-separated list of user names. simple as that.

administrators can change the password or the members of the group. they also have the same permissions as the members do (see below). so yeah, they're doing both jobs. slay. 👑

• members — also has to be a comma-separated list of user names.

members can access the group without being prompted for a password. no password popup, no waiting, they just walk in. 💅

you should use the same list of users as in /etc/group. like, keep them in sync, bestie, don't be messy. 🌈

---

🦋 FILES 🦋

• /etc/group — group account information. the public one. the extrovert.
• /etc/gshadow — secure group account information. the introvert. the one with the secrets. 🤫

---

💜 SEE ALSO 💜

gpasswd(5), group(5), grpck(8), grpconv(8), newgrp(1).

go read those too, iykyk. 📚✨

---

and that's the whole vibe check on gshadow 🫶 this page came to you from shadow-utils 4.20.0, dated 07/30/2026 — so go forth, keep your group secrets safe, and remember: the password field does not miss. 💖🎀🌸