3

Looking in /etc/shadow, I can see several users that have the exact same salt and hash value (and thus password).

How could the system end up like this? Does this mean the password was not generated through passwd (thought passwd randomized the salt)? And is this particularly bad?

2
  • Is there the possibility that these fields have been copied by hand?
    – dr_
    Aug 3, 2015 at 15:42
  • Entries added by vipw or another editor/oob process?
    – Drav Sloan
    Aug 3, 2015 at 20:34

1 Answer 1

5

Setting a password with passwd or chpasswd generates a random salt, so users who happen to have the same password would not have identical hashes. In order to have identical hashes this way, you'd have to have a misconfigured system that somehow doesn't save entropy between reboots, and systems that are so completely identical as to repeat the random seed (that can happen with VMs, especially when resuming from snapshots), and for all the passwords to be generated after reading exactly the same number of bytes from /dev/urandom. This is highly unlikely.

Thus, if you see identical hashes, it means that the hashes were copied. The passwords were deliberately made the same, rather than by coincidentally setting the same password multiple times. Either the administrator directly edited the password database and copying the hashes, or they used something like chpasswd -e to supply hashes.

The only bad consequence of repeating a password hash is that it makes it apparent that the accounts have the same password. With distinct salts, as is normally the case, it would be impossible to tell that two accounts have the same password except by guessing the password.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .