How to create a user and give it read permission to /etc/shadow file?

I would like to give my web server user (nginx) read access to the /etc/shadow file and I would like to confirm the steps that I am taking to do this. The system I am using is a CentOS 7.

1. First I created a group called shadow: groupadd shadow
2. Then I added the web server user (nginx) to the group shadow: usermod -aG shadow nginx
3. Then I changed the owner to root and changed the file group owner to group shadow: chown root:shadow /etc/shadow
4. Then I allowed read permissions for all users in the shadow group to read the /etc/shadow file: chmod g+r /etc/shadow

After conducting those steps I ran ls -l /etc/shadow and I see the following output

----r-----. 1 root shadow 1390 Aug 30 12:51 /etc/shadow

Are these steps that I am following correct? Please let me know, and I can provide additional information if needed.

Changing an owner group of such important file could even break some things, which is dangerous.

The proper secure way to achieve that is to use POSIX ACLs:

setfacl -m u:special_user:r /etc/shadow

Another problem here is that you gave this right to Nginx, a web server. Which, I suppose, runs some web application. And it is very bad idea to have direct access to /etc/shadow from web application.

This may seem counterproductive, but this is the way all serious systems do such things: they include private secure proxy service which does all security checks and web front end only can talk to this proxy service to have some access to sensitive data or do other sensitive things. For example, this is the way Proxmox VE is built: there is pvedaemon which does dangerous things, and pveproxy (a web server) only talks to pvedaemon when it needs to do such things.

The third problem is that you access this file at all. What you intend to do? This file is a part of PAM suite. What if some system authentication is modified so it is not using a shadow file, or it is moved? You should use PAM library calls which will do all that stuff for you.

That looks like the output of

chmod g=r /etc/shadow

and not

chmod g+r /etc/shadow

aka. you seem to accidentally have used an equal sign instead of the addition sign.

Edit: I just double checked on my system and the permissions for my /etc/shadow file looks like this:

`----------. 1 root root 1183 20 Aug 11.53 /etc/shadow`

So it looks like your permissions are to be expected!