crypt() on different machines

Question

Because of a hardware issue i need to migrate many virtual users to a new machine. Their passwords stored in MySQL encrypted with ENCRYPT which using crypt()eventually.

Maybe it's my fault but salt wasn't added when passwords were stored so they're totally random. My basic idea was to dump the database then import it. When i tried to store the same string in the same machine with ENCRYPT it gave me different results. Will users' passwords work on the new machine?

Update on environment and encrypting method:

• The old machine is running Debian Etch with MySQL 5.0
• New machine will run Debian Squeeze with MySQL 5.1
• The encrypting method is MySQL's default ENCRYPT
• Salt wasn't added originally
• I don't know the passwords

Thank you for your feedback, fabrik

Answer 1

From the provided link to ENCRYPT()

If no salt argument is given, a random value is used.

salt is a 2 character string, saved in the beginning of the encrypted text. e.g. encrypting a string with salt='df', 'df' is in the start of the output product.

mysql> SELECT ENCRYPT('hello','df');
+-----------------------+
| ENCRYPT('hello','df') |
+-----------------------+
| dfbVa429UeC0U         | 
+-----------------------+
1 row in set (0.00 sec)

Another example, no salt

mysql> SELECT ENCRYPT('hello');
+------------------+
| ENCRYPT('hello') |
+------------------+
| oBSydDfeNx5ug    | 
+------------------+
1 row in set (0.00 sec)

Now use the first two characters of the previous string as salt

mysql> SELECT ENCRYPT('hello','oB');
+-----------------------+
| ENCRYPT('hello','oB') |
+-----------------------+
| oBSydDfeNx5ug         | 
+-----------------------+
1 row in set (0.00 sec)

Same output.

You most probably won't have a problem, but just to be 100% sure (that crypt implementation is the same), create a test account on the old machine and migrate it to the new one. Check if the password works for both of them.

EDIT:

salt is ALWAYS stored in the first letters of the password's encrypted string. There is NO WAY salt is lost, without salt users wouldn't be able to login in your old machine in the first place. You do not need to (and you shouldn't) know any passwords.

If you're migrating from etch to squeeze, the most sensible way to go, is to setup a testing server with Debian Squeeze. You do not need hardware to do that, setup a VirtualBox guest for example. Then create a new user in your old machine and migrate his account to the testing machine. If the password works for both machines, then you 're good to go, it's the only way to be 99.9% sure. Testing migrations is a must anyway, you should worry about a lot more problems appearing in them.