I understand the password field consists of I can see how a salt would prevent a simple dictionary lookup (but, see note below) if the file were readable to everyone, as was the case before passwords were shadowed; but since /etc/shadow has tight permissions, what is the point of having a salt? Is it to add an extra level of protection in the event an unauthorized someone somehow manages to access it?

Note: In the event that encoded passwords and their salts are readable by everyone, it seems to me a dictionary attack would still be possible: the dictionary just gets lengthened by some constant factor to take new variations introduced by the salt into account. This just delays the inevitable.

This function definition helps explain it a little bit. It looks like you're right; it just helps to prolong the inevitable. But prolonging the task of password-cracking can help security, at least a little bit, since it can multiply the number of guesses an attacker must make.

Though, given what we've been hearing about MD5 lately, we may need a new password-hash scheme before long anyway.

Thanks for the interesting information, wapcaplet.