Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #212210

Re: odd passwd problem.

From <tomas@tuxteam.de>
Newsgroups linux.debian.user
Subject Re: odd passwd problem.
Date 2019-08-03 20:10 +0200
Message-ID <yr6DD-5lZ-5@gated-at.bofh.it> (permalink)
References <yqgvo-5Qm-3@gated-at.bofh.it> <yqShk-4wI-5@gated-at.bofh.it> <yr2Tn-2Zr-5@gated-at.bofh.it> <yr3mp-39H-1@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Sat, Aug 03, 2019 at 10:32:02AM -0400, Gene Heskett wrote:
> On Saturday 03 August 2019 10:03:18 David Wright wrote:

[...]

> > AIUI passwords are not encrypted, they're hashed.

Yep. In theory, there's no "way back" from the hash to the
password. In practice, though...

> And apparently each hash is unique? I've checked 4 machines here, and the 
> shadow files entry for me is different on all 4 machines.

That's the salt. To make "reverse lookup" attacks more difficult
for "typical" passwords, some salt is added: a small random prefix,
which is typically included in the hashed password info (it better
had, otherwise you can't check the password)

Here's a typical shadow entry (somewhat modified and very much
shortened, to protect the innocent ;-)

  username:$6$lU7moTub$AmalgHken:18080:0:99999:7:::
     ^      ^ ----^--- ----^----
     |      |     |        |      other stuff
     |      |     |        hash of (salt + password) (here shortened)
     |      |     salt
     |      hash algorithm (6 = sha512)
     user name

See man crypt(3) for details (the crypt chapter in libc's info is more
informative). The actual representation as characters is most probably
base64 encoded.

In short, yes, assuming your random number generator isn't broken,
you'll get a different salt every round and thus a different password
hash. So we hope :-)

Cheers
-- tomás

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

odd passwd problem. Gene Heskett <gheskett@shentel.net> - 2019-08-01 12:30 +0200
  Re: odd passwd problem. Cindy Sue Causey <butterflybytes@gmail.com> - 2019-08-01 14:10 +0200
    Re: odd passwd problem. Gene Heskett <gheskett@shentel.net> - 2019-08-01 23:00 +0200
      Re: odd passwd problem. David Wright <deblis@lionunicorn.co.uk> - 2019-08-03 15:50 +0200
        Re: odd passwd problem. Gene Heskett <gheskett@shentel.net> - 2019-08-03 16:20 +0200
  Re: odd passwd problem. David Wright <deblis@lionunicorn.co.uk> - 2019-08-01 15:50 +0200
    Re: odd passwd problem. Gene Heskett <gheskett@shentel.net> - 2019-08-01 23:00 +0200
  Re: odd passwd problem. Andrei POPESCU <andreimpopescu@gmail.com> - 2019-08-01 16:30 +0200
    Re: odd passwd problem. Gene Heskett <gheskett@shentel.net> - 2019-08-01 23:00 +0200
      Re: odd passwd problem. Gene Heskett <gheskett@shentel.net> - 2019-08-03 04:50 +0200
        Re: odd passwd problem. Curt <curty@free.fr> - 2019-08-03 10:00 +0200
          Re: odd passwd problem. Gene Heskett <gheskett@shentel.net> - 2019-08-03 11:30 +0200
            Re: odd passwd problem. Curt <curty@free.fr> - 2019-08-03 12:00 +0200
              Re: odd passwd problem. Gene Heskett <gheskett@shentel.net> - 2019-08-03 12:30 +0200
                Re: odd passwd problem. Curt <curty@free.fr> - 2019-08-03 13:00 +0200
                Re: odd passwd problem. Gene Heskett <gheskett@shentel.net> - 2019-08-03 15:50 +0200
            Re: odd passwd problem. Curt <curty@free.fr> - 2019-08-04 10:10 +0200
          Re: odd passwd problem. Gene Heskett <gheskett@shentel.net> - 2019-08-03 12:20 +0200
        Re: odd passwd problem. David Wright <deblis@lionunicorn.co.uk> - 2019-08-03 16:10 +0200
          Re: odd passwd problem. Gene Heskett <gheskett@shentel.net> - 2019-08-03 16:40 +0200
            Re: odd passwd problem. David Wright <deblis@lionunicorn.co.uk> - 2019-08-03 17:10 +0200
              Re: odd passwd problem. Gene Heskett <gheskett@shentel.net> - 2019-08-03 17:40 +0200
                Re: odd passwd problem. David Wright <deblis@lionunicorn.co.uk> - 2019-08-03 18:00 +0200
                Re: odd passwd problem. Gene Heskett <gheskett@shentel.net> - 2019-08-03 18:40 +0200
                Re: odd passwd problem. David Wright <deblis@lionunicorn.co.uk> - 2019-08-03 20:50 +0200
                Re: odd passwd problem. Gene Heskett <gheskett@shentel.net> - 2019-08-03 22:40 +0200
            Re: odd passwd problem. <tomas@tuxteam.de> - 2019-08-03 20:10 +0200
  Re: odd passwd problem. mick crane <mick.crane@gmail.com> - 2019-08-03 13:10 +0200
    Re: odd passwd problem. Gene Heskett <gheskett@shentel.net> - 2019-08-03 16:00 +0200
      Re: odd passwd problem. Andrei POPESCU <andreimpopescu@gmail.com> - 2019-08-03 16:20 +0200
        Re: odd passwd problem. Gene Heskett <gheskett@shentel.net> - 2019-08-03 16:50 +0200
          Re: odd passwd problem. Richard Hector <richard@walnut.gen.nz> - 2019-08-04 09:10 +0200
            Re: odd passwd problem. David Wright <deblis@lionunicorn.co.uk> - 2019-08-04 17:50 +0200
              Re: odd passwd problem. Gene Heskett <gheskett@shentel.net> - 2019-08-04 18:10 +0200
      Re: odd passwd problem. mick crane <mick.crane@gmail.com> - 2019-08-03 16:40 +0200
        Re: odd passwd problem. Gene Heskett <gheskett@shentel.net> - 2019-08-03 17:40 +0200
          Re: odd passwd problem. mick crane <mick.crane@gmail.com> - 2019-08-03 17:50 +0200
            Re: odd passwd problem. Gene Heskett <gheskett@shentel.net> - 2019-08-03 18:30 +0200
              Re: odd passwd problem. mick crane <mick.crane@gmail.com> - 2019-08-03 18:40 +0200

csiph-web