Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

If I cat /etc/shadow I can get the encrypted passwords of root and my user.

These passwords are the same (I know, bad security) for each account, but in /etc/shadow they show up as being different encrypted strings.

Why? Are different algorithms used for each?

share|improve this question
    
I would recommend reading this as a good starting point. The short answer is that the hashes are salted, and that a hash without salt is no hash at all. –  Boris the Spider Jul 30 at 7:44

3 Answers 3

up vote 8 down vote accepted

Separate users means a separate User ID, and therefore separate hashes will be involved with the algorithm.

Even a user with the same name, same password, and created at the same time will (with almost certain probability) end up with a different hash. There are other factors that help create the encryption.

If you want to look at a quick example here it may explain it better.

share|improve this answer
14  
Just to mention the word here: it's called salting the hash. –  Ulrich Schwarz Jul 30 at 6:15
1  
Separate users doesn't necessarily mean separate User IDs. User IDs have no bearing on this. The primary key in /etc/passwd, /etc/shadow is the user name, not user ID (which is not even mentioned in /etc/shadow). –  Stéphane Chazelas Jul 30 at 7:03
    
The explanation doesn't quite answer the question. What has the user ID to do with that at all? Also, the URL does not really shed light on the answer to the question. –  countermode Jul 30 at 13:34
    
@StéphaneChazelas No, separate users means separate user IDs. There can be multiple entries in the user database(s) with different user names for the same user ID, but these are all the same user, sharing all security contexts (file ownership, signals, etc.) and differing only in login methods (e.g. different passwords and different shells but leading to the same account). –  Gilles Jul 30 at 23:09
    
@Gilles, I don't agree. You can have different users with the same uid but different gid and supplementary gids (see how the members in /etc/group are referenced by name, not uid), different login parameters... It's less and less common, especially considering that things like sudo don't work well with that. –  Stéphane Chazelas Jul 31 at 6:46

The algorithm is the same. Modern shadow-suites use pluggable authentication modules (PAM), and PAM lets you configure one hashing algorithm. It's all about "salting", which means randomizing the password to give the very effect that you're asking about.

Salting is a counter-measure to dictionary attacks, where an attacker with a dictionary of known password/hash pairs tries to find out, whether the given hash value for an unknown password matches the hash value for one of the known passwords.

Salting prevents that as a different salt value leads to a different hash value, so it doesn't matter that the password are equal. (It's nonetheless bad practice, but for other reasons.) For the dictionary attack to succeed, the attacker now has to have dictionaries for every possible salt value. A truly random salt of sufficient size will make the success probability of such an attack negligible.

Suggested reading: How are passwords stored in Linux (Understanding hashing with shadow utils)

share|improve this answer

In the shadow file you will see a number between $$ (say $1$ or something like that). It indicates which hashing algorithm is used by your machine. Identify the algorithm and see how it works. For instance, $6$ is SHA 512 which is designed in such a way that, even if 2 people have the same password, the hash digest of their password will be different.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.