Shadow password encryption

mnisski · 05-27-2004, 08:29 PM

Does anyone know the encryption routine for linux shadow passwords?
I have redhat9 running and am creating a script to add a user. So far no problem but I am confused as to how the regular passwd function creates the password stored in /etc/shadow.
Is it MD5 or crypt, if crypt what is the salt they use? If MD5 is it hex.
I read the salt was the first 12 characters of the user's crypted password.
I read the salt was the first 2 characters of the user's uncrypted password.

But None of these work.

Any guidance is appreciated.

Tinkster · 05-27-2004, 08:51 PM

Hmmm ...

man -k shadow

Code:

shadow               (3)  - encrypted password file routines
shadow               (5)  - encrypted password file

man 5 shadow

Code:

       The  password field must be filled.  The encryped password
       consists of 13 to 24  characters  from  the  64  character
       alphabet  a thru z, A thru Z, 0 thru 9, . and /.  Refer to
       crypt(3) for details on how this string is interpreted.

man 3 crypt doesn't say anything about salt...

Hmmm ...

http://www.google.co.nz/linux?hl=en&...a=lr%3Dlang_en

First entry ....

http://linuxselfhelp.com/howtos/Shad...d-HOWTO-2.html

Quote:

On a Linux system without the Shadow Suite installed, user information including passwords is stored in the /etc/passwd file. The password is stored in an encrypted format. If you ask a cryptography expert, however, he or she will tell you that the password is actually in an encoded rather than encrypted format because when using crypt(3), the text is set to null and the password is the key. Therefore, from here on, I will use the term encoded in this document.

The algorithm used to encode the password field is technically referred to as a one way hash function. This is an algorithm that is easy to compute in one direction, but very difficult to calculate in the reverse direction. More about the actual algorithm used can be found in section 2.4 or your crypt(3) manual page.

When a user picks or is assigned a password, it is encoded with a randomly generated value called the salt. This means that any particular password could be stored in 4096 different ways. The salt value is then stored with the encoded password.

Cheers,
Tink

mnisski · 05-28-2004, 05:54 PM

Quote:

Originally posted by Tinkster
Hmmm ...

man -k shadow

Code:

shadow (3) - encrypted password file routines shadow (5) - encrypted password file

man 5 shadow

Code:

The password field must be filled. The encryped password consists of 13 to 24 characters from the 64 character alphabet a thru z, A thru Z, 0 thru 9, . and /. Refer to crypt(3) for details on how this string is interpreted.

man 3 crypt doesn't say anything about salt...

Hmmm ...

http://www.google.co.nz/linux?hl=en&...a=lr%3Dlang_en

First entry ....

http://linuxselfhelp.com/howtos/Shad...d-HOWTO-2.html

Helpfull, Thankyou. That narrows it down to the crypt function.
reviewed all documentation but nowhere does it really say what salt is used by the shadow password suite.
Still open for comments.

Cheers,
Tink

phlogistonjohn · 05-28-2004, 06:24 PM

Check out the 'useradd' command via man. If you're writing a shell script you might just be able to wrap this command, which might remove the need to edit /etc/shadow manually.

If you really gotta do it manually, the salt is the set of characters at the beginning of the hashed (encrypted) password. It can either be two characters, or a sequence of "$1$<string>$". This is explained in the GNU EXTENSION of the crypt(3) manpage. (Assuming you are using GNU of course :-))