The /etc/shadow file stores password information for Linux system users and is also known as the "shadow file." The /etc/passwd file is readable by all users, which can easily lead to password leakage. Therefore, Linux systems separate user password information from /etc/passwd and store it in /etc/shadow. Only the root user has read permission for /etc/shadow; other users have no access, ensuring the security of user passwords. If the permissions of this file change, it may indicate a malicious attack.
If the host's /etc/shadow has been tampered with illegally, be sure to carefully inspect the host environment for possible intrusion and change the host user passwords.