Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 3 down vote favorite

We have an automated sync-routine that uses useradd to create new users on a Ubuntu 10.04 machine. The application launching the routine provided both username and CRYPT-encrypted password. However, since we changed how passwords are handled in order to include LDAP support, passwords now don't have to be CRYPT but can also be MD5 or SHA-1. In fact, SHA-1 is the new default. This however now causes problems.

I have read up on how /etc/shadow is handled and there doesn't seem to be an id for SHA-1, only for SHA-256/SHA-512($5$ and $6$ respectively). The only thing I found was to change the whole thing from CRYPT to SHA-1. We could do that, but we wanted the whole transition to be as non-disruptive as possible.

Is there a way to use both CRYPT and SHA-1 passwords together?

NOTES
- The main application is a CMS on an entirely different server. The linux server in question is a local machine(slave) at the client's location in order to provide local services.
- We are aware that we could switch the entire system out to use LDAP-only, but, as outlined earlier, we don't want to change everything at once.

share|improve this question
I don't see why you couldn't use different password hashing mechanisms on the same system, as long as they are all supported by the system. According to stackoverflow.com/a/9133085/486504 $5$ is SHA-1. Did you actually try this, and what exact problems did you encounter? – Michael Kjörling Sep 26 '12 at 9:50
We tried using both $5$ and $6$, neither of which worked. All other services that received hashes from the CMS worked without trouble. 'useradd' actually didn't put the hash into /etc/shadow itself, it only put a '=' character in its place. – Mike Sep 26 '12 at 9:56

1 Answer

up vote 2 down vote accepted

Why not authenticate those users for which you only have an unsalted SHA-1 hash of their password by another means than /etc/shadow.

Using PAM, you can have as many authentication modules as you want and stack them as you want. You can keep pam_unix.so for some users and use pam_ldap.so for the rest.

share|improve this answer
Will take a look into PAM and come back with questions (or possibly/hopefully to accept this answer). – Mike Sep 26 '12 at 14:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.