Re: What is md5sum?

From: Carlos Moreno (moreno_at_mochima_dot_com_at_xx.xxx)
Date: 06/30/04

  • Next message: bi-weekly: "A new reader? Welcome to comp.os.linux.setup, read this first if you're new here (FAQ)" 
    Date: Tue, 29 Jun 2004 18:58:34 -0400

    Michael Heiming wrote:

    >>Another typical use for MD5 codes (although not for the md5sum
    >>command) is to store passwords. You don't want the administrator
    >>(root) to know the password that you chose. A simplified
    >
    > Why should he? UID 0 doesn't need any user password at all, the
    > system doesn't ask if root uses 'su - <username>'.
    >
    > One of the reasons should be to make it virtually impossible to
    > get the password back from a somehow lost shadow file.

    True as well.

    Some time ago, when I had not the slightest idea about how these
    things are implemented (I had just started using a Unix system),
    I had a discussion with the system administrator; the discussion
    started because he somehow wanted me to enter my password or
    something like that; I told him that he should know my password,
    he is root. He explained to me that no, he can not know my
    password, and that he didn't need to know it, as he, as user
    root, can do anything that would require me to supply my user
    password (well, this is a simplified phrasing, but you know what
    I'm saying). I then didn't understand the logic, arguing that if
    he, as user root, can access anything that belongs to me, what
    would I gain by hiding the password from him? -- the answer
    was very trivial, and after he explained it to me, it kind of
    got stuck in my mind as one of the reasons why you would use
    hashed passwords.

    But of course, the reason you mention is also important -- perhaps
    the most important one; after all, in principle one trusts the
    system administrator of a system that one uses, so hiding the
    password from him/her should be considered not-too-important (at
    least in an ideal world :-)).

    Carlos 

    --
  • Next message: bi-weekly: "A new reader? Welcome to comp.os.linux.setup, read this first if you're new here (FAQ)"

    Relevant Pages

    • Re: antivirus free
      ... programmers out there that write software that requires you run it with ... administrator authentication to perform certain actions. ... (system administrator): He has no access to files and folders of other ... Root is on all OS X systems, but it has to be activated before it is ...
      (comp.sys.mac.misc)
    • Re: Fork Bombing Patch
      ... if non root user request admin for more number of processes than root ... and if that user is not trustworthy and if does fork bombing attack it ... Perhaps you should file a bug with your distribution if you believe the default settings in limits.conf are too high. ... If we merge this patch, every cracking toolkit in existence will add such a feature, because log spamming makes it harder for the administrator to find more important messages, and even if the administrator uses grep judiciously to filter them out, that doesn't help if logrotate has already deleted the log containing the information they need to keep /var/log from filling up. ...
      (Linux-Kernel)
    • RE: root
      ... I tried to hit F8 when the comp started up. ... administrator on my comp. ... On this credit card account, that I accessed tonight, it ... As far as root goes, I was also just wondering if there is ...
      (microsoft.public.windowsxp.security_admin)
    • Re: root password setting unoffered at install
      ... Since, with RBAC you can't by mistake do "rm -rf /" and delete your own machine if you are currently active with the "printer administrator" role, for example. ... Whereas with the way SUDO is configured on Ubuntu, ... It is roughly equivalent to having a root user... ...
      (Ubuntu)
    • Re: 837272 & 839643 Updates wont install on W2K SP4 domain PCs - Permission Error
      ... >> well as the last 20 lines from the Windows Update.log ... >> permission to update Windows 2000. ... >> Please contact your system administrator. ...
      (microsoft.public.windowsupdate)