Re: passwd file

From: Matt (nospam_ng_at_fileholder.net)
Date: 12/14/04 

Date: Tue, 14 Dec 2004 00:10:45 -0600

>>I have a password file that looks like so.
>>
>>matthew:38GB3fsjfwH7Y
>>etc.
>>
>>Can anyone tell me how this hashed password is generated? I know its a
>>one
>>way hash and I cannot reverse it. I just want to know how the output was
>>created.
>
> The two first characters are 'salt' used for the hashing, the rest is the
> hash result of 'crypt()'.
>
> An example to hash the word 'password' with salt 'xx' in perl:
> perl -e 'print crypt("password","xx"),"\n";'

This is exactly the info I needed. I was able to export my database to a
report then with a script parse it and create a passwd file. Saved me a lot
of typing.

Thanks.

Matthew

> The salt used should be random (esp. DO NOT pick initial two characters of
> the password), and should consist of two characters from set
> '.', '/', 0..9, 'A'..'Z', 'a'..'z' .
> --
> Wolf a.k.a. Juha Laiho Espoo, Finland
> (GC 3.0) GIT d- s+: a C++ ULSH++++$ P++@ L+++ E- W+$@ N++ !K w !O !M V
> PS(+) PE Y+ PGP(+) t- 5 !X R !tv b+ !DI D G e+ h---- r+++ y++++
> "...cancel my subscription to the resurrection!" (Jim Morrison)

Relevant Pages

  • Re: URGENT SECURITY ADVISORY FOR SSH SECURE SHELL 3.0.0
    ... On systems that use the standard unix crypt(), ... character hash). ... character salt from the password file and a password from the user, ... result to the hash string in the password file. ...
    (Bugtraq)
  • Re: password security in *nix systems?
    ... system merely needs to hash the password you enter and compare it to ... The problem is that with sufficient computing time, ... * Change passwords regularly enough that an old password file quickly ... either this cracker was an ex-admin there or he managed to get root ...
    (comp.os.linux.security)
  • Re: Firefoxs Saved Passwords
    ... upgrading. ... it harder for someone to grab my password file and use it. ... true because the password file is not a one-way hash, ... the original password out of it. ...
    (Fedora)
  • Re: Firefoxs Saved Passwords
    ... upgrading. ... As for not being able to just grab the old password file, ... true because the password file is not a one-way hash, ... the original password out of it. ...
    (Fedora)