necessary to change the permission of the archive /etc/shadow for 640.

But when I modify the password with the command "passwd" the permission comes back automatically toward 600.

How I decide this problem?

The shadow file is specifically designed to be read ONLY by root. The point in this file is to prevent people from seeing your encrypted passwords because there are commands like "crack" than can figure out many passwords from their encrypted values. Prior to introduction of the shadow file the encrypted passwords were stored in /etc/passwd and if they weren't properly formed were very easy to break.

Why do you want to make this file 640? Perhaps there's another way to accomplish your purpose that doesn't break intrinsic security of the system.

Necessary to leave the archive /etc/shadow with permission 640, and the group "shadow-readers".

It is for implementing module PAM of the apache.

The apache will only go up with this group, to make authentication of the users.

thankz

My default SuSE installation created the /etc/shadow file as 640 with root:shadow ownership.

It is possible that a Linux hardening technique has made the file 600. Do you have a cron job that runs chkstat? If so you can look at the /etc/permissions, /etc/permissions.local files and the files in /etc/permissions.d if you have these files and directories. These are part of the SuSE configuration. I don't know about other distributions. (I haven't looked into this on Debian yet even though I listed Debian as one of my distros.)

My distro is redhat, the problem is in the program "passwd",it modifies the permissions automatically.

It will be that some configuration exists to change this permission?
thankz

This may have something to do with PAM. I don't know because I have a lot to learn about PAM. See if you can check the PAM configuration files. Look for things to do with the Apache user account or the Apache authorization process. Look at the Red Hat web site for more information about how Red Hat has set up the PAM configuration. Good luck.

I already looked for in many places (Site of the PAM module, apache...) I am really difficult to find a solution for this case.

Thankz