Well that supposition can be checked easily... $ dpkg -S /etc/login.defs login: /etc/login.defs https://packages.ubuntu.com/login https://packages.ub

Well that supposition can be checked easily... $ dpkg -S /etc/login.defs login: /etc/login.defs https://packages.ubuntu.com/login https://packages.ubuntu.com/login -> hirsuite -> changelog gets you to https://changelogs.ubuntu.com/changelogs/pool/main/s/shadow/shadow_4.8.1-1ubuntu8/changelog https://changelogs.ubuntu.com/changelogs/pool/main/s/shadow/... where you can see this is an ubuntu-specific patch introduced in version 1:4.8.1-1ubuntu8