Lost password

mrlinux2000 · 11-08-2009, 07:35 AM

Hello Folks
am a linux admisnistrator "Root", one of my users lost his password and i want to get it back , am using fedora core 3 how can that be done ... am waiting for any kind of help

thank you so much

pixellany · 11-08-2009, 07:49 AM

I think you have to simply assign the user a new password using "passwd username". Replace "username" with the name of your user.

JamesChamberlain · 11-08-2009, 08:16 AM

You've lost the root password?
Or do you want to change a user password?

Root password can be reset by booting into single user mode.
User password can be reset by doing '# passwd user' as root.

mrlinux2000 · 11-08-2009, 09:02 AM

i want to get a passwrod for a user not root and not changing it ...

pixellany · 11-08-2009, 09:15 AM

You did not respond to my reply in the duplicate thread. I do not believe you can recover a password---I think you have to assign a new one.

MensaWater · 11-08-2009, 09:26 AM

The second field of /etc/shadow is the encrypted password of the user. If you have a recent backup you can add that password back by getting it out of the old /etc/shadow and pasting it into the current one.

pixellany · 11-08-2009, 09:51 AM

Quote:

Originally Posted by jlightner

The second field of /etc/shadow is the encrypted password of the user. If you have a recent backup you can add that password back by getting it out of the old /etc/shadow and pasting it into the current one.

Good point---I never backup stuff in /etc so this obvious option did not make it into my brain....

rjlee · 11-08-2009, 09:58 AM

Linux passwords are stored using a one-way encryption system. Whenever the password is typed in, it is encrypted into an encoded format. To verify a user's login, the system just compares the encrypted forms.

There is no reverse algorithm for the encryption. If you want to find out the user's password, then the only way to do it is to try every possible combination until you find a match. If it was possible to easily reverse-engineer the password from its encrypted form, then securing the password would be much harder.

pixellany · 11-08-2009, 10:03 AM

Quote:

Originally Posted by jlightner

The second field of /etc/shadow is the encrypted password of the user. If you have a recent backup you can add that password back by getting it out of the old /etc/shadow and pasting it into the current one.

But that does not help if the user has lost his/her password......

pcunix · 11-08-2009, 10:18 AM

Yes, there is a reverse.

See [LINK REMOVED BY MODERATOR] for an example of using John the Ripper to check passwords to be sure they aren't easy to crack by such tools.

True, you can't be CERTAIN that was the password, but the chances are good.

// pcunix, the LQ Rules make it clear that this isn't the place to receive or provide help with cracking.

win32sux · 11-08-2009, 10:53 AM

Quote:

Originally Posted by pcunix

Yes, there is a reverse.

No, there isn't. A password cracker can't generate the password from the hash. It generates its own hash from its own password and compares the result with the original hash. The direction of the operation isn't reversed at any point.

win32sux · 11-08-2009, 10:59 AM

Quote:

Originally Posted by mrlinux2000

i want to get a passwrod for a user not root and not changing it ...

Why don't you want to change it?

pcunix · 11-08-2009, 11:02 AM

Quote:

Originally Posted by win32sux

No, there isn't. A password cracker can't generate the password from the hash. It generates its own hash from its own password and compares the result with the original hash. The direction of the operation isn't reversed at any point.

Exactly. And almost always, that IS the original password. The link I gave shows a good example of that where the user password was "fred123". The ripper found exactly that quickly.

That IS a reversal. A brute force reversal, but a reversal none the less.

win32sux · 11-08-2009, 11:34 AM

Quote:

Originally Posted by pcunix

That IS a reversal. A brute force reversal, but a reversal none the less.

Any type of password cracking which uses guessing (this includes both brute force and dictionary) is NOT doing anything in reverse. It's the exact same operation which was done when the original password hash was originally created, the difference being that you're doing it a gazillion times and the resulting hash of each guess is compared to see if it matches the original one. It's not reversal, the direction remains the same. You're just doing tons of comparison.

pcunix · 11-08-2009, 11:56 AM

Quote:

Originally Posted by pcunix

// pcunix, the LQ Rules make it clear that this isn't the place to receive or provide help with cracking.

The purpose of that is to help administrators detect weak passwords. It's not a cracking tool as you need root to be able to use it!

You know, I understand the need for rules. But I'm getting a bit annoyed by the silliness of some of them.