Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

In Linux I can create a SHA1 password hash using sha1pass mypassword. Is there a similar command line tool which lets me create sha512 hashes? Same question for Bcrypt and PBKDF2.

share|improve this question
    
Don't you mean sha1sum? –  user16144 Oct 17 '12 at 18:43
1  
@Tichodroma no, there is actually a sha1pass command, part of the syslinux-common package on Debian. –  derobert Oct 17 '12 at 18:44
    
Ah, thanks. You never stop learning :) –  user16144 Oct 17 '12 at 18:48
1  
There's a sha512sum command that's part of coreutils, and similarly openssl sha512 -- but neither does the extra stuff that sha1pass does. –  Keith Thompson Oct 17 '12 at 20:37

4 Answers 4

up vote 15 down vote accepted

Yes, you're looking for mkpasswd, which (at least on Debian) is part of the whois package. Don't ask why...

anthony@Zia:~$ mkpasswd -m help
Available methods:
des     standard 56 bit DES-based crypt(3)
md5     MD5
sha-256 SHA-256
sha-512 SHA-512

Unfortunately, my version at least doesn't do bcrypt. If your C library does, it should (and the manpage gives a -R option to set the strength). -R also works on sha-512, but I'm not sure if its PBKDF-2 or not.

If you need to generate bcrypt passwords, you can do it fairly simply with the Crypt::Eksblowfish::Bcrypt Perl module.

share|improve this answer

On any of the Red Hat distros such as Fedora, CentOS, or RHEL the command mkpasswd doesn't include the same set of switches as the version typically included with Debian/Ubuntu.

NOTE: The command mkpasswd is actually part of the expect package, and should probably be avoided. You can find out what package it belongs to with either of these commands.

$ yum whatprovides "*/mkpasswd"
-or-
$ repoquery -q --file */mkpasswd

Example

$ repoquery -q --file */mkpasswd
expect-0:5.43.0-8.el5.x86_64
expect-0:5.43.0-8.el5.i386

Both of these methods are superior to using rpm since the packages do not have to be installed to locate */mkpasswd.

Workarounds

To work around this you can use the following Python or Perl one-liners to generate SHA-512 passwords. Take note that these are salted:

Python

$ python -c "import crypt, getpass, pwd; \
             print crypt.crypt('password', '\$6\$saltsalt\$')"
$6$saltsalt$qFmFH.bQmmtXzyBY0s9v7Oicd2z4XSIecDzlB5KiA2/jctKu9YterLp8wwnSq.qc.eoxqOmSuNp2xS0ktL3nh/

Perl

$ perl -e 'print crypt("password","\$6\$saltsalt\$") . "\n"'
$6$saltsalt$qFmFH.bQmmtXzyBY0s9v7Oicd2z4XSIecDzlB5KiA2/jctKu9YterLp8wwnSq.qc.eoxqOmSuNp2xS0ktL3nh/

In these examples the password is the string "password" and the salt is "saltsalt". Both examples are using $6$ which denotes that you want crypt to use SHA-512.

share|improve this answer
    
rpm-based version from expect package seems to be an ancient variant from 1994. –  Mxx Jan 12 at 9:40
    
@Mxx - I don't understand what you're saying? –  slm Jan 12 at 9:56
    
There's no separate mkpasswd package for RHEL/CentOS/Fedora. If you do yum whatprovides */mkpasswd you'll see that there's expect-5.44.1.15-4.el6.x86_64(or similar version). If you install that package and run its mkpasswd, like you said, it doesn't include same set of switched. And if you run man mkpasswd you'll see that it is from ~1994. –  Mxx Jan 12 at 16:40
    
@Mxx - OK that makes much more sense. I didn't know what you were saying. I've updated the A to include relev. info about the feedback you've provided. Thanks for taking the time to QC it 8-). BTW I wouldn't trust the dates in man pages, they're notoriously wrong. –  slm Jan 12 at 17:21
    
For the python one-liner, you can use crypt.mksalt(crypt.METHOD_SHA512) to generate the salt instead of using a fixed one. –  Jake Cobb Aug 26 at 0:15

Run this command:

$ /sbin/grub-crypt --sha-512

then enter the word you want hashed.

share|improve this answer

You can use sha512sum:

echo "password" | sha512sum
share|improve this answer
13  
This answer is incorrect. The command will not generate a valid SHA-512 password hash. It will simply calculate the checksum of the string password\n (note that there is also a newline in the end). Unix password hashes are salted and include a hash version code between two "$" symbols. See the answer by @slm. –  zorlem Nov 27 '13 at 0:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.