3

Looking in /etc/shadow, I can see several users that have the exact same salt and hash value (and thus password).

How could the system end up like this? Does this mean the password was not generated through passwd (thought passwd randomized the salt)? And is this particularly bad?

  • Is there the possibility that these fields have been copied by hand? – dr01 Aug 3 '15 at 15:42
  • Entries added by vipw or another editor/oob process? – Drav Sloan Aug 3 '15 at 20:34
5

Setting a password with passwd or chpasswd generates a random salt, so users who happen to have the same password would not have identical hashes. In order to have identical hashes this way, you'd have to have a misconfigured system that somehow doesn't save entropy between reboots, and systems that are so completely identical as to repeat the random seed (that can happen with VMs, especially when resuming from snapshots), and for all the passwords to be generated after reading exactly the same number of bytes from /dev/urandom. This is highly unlikely.

Thus, if you see identical hashes, it means that the hashes were copied. The passwords were deliberately made the same, rather than by coincidentally setting the same password multiple times. Either the administrator directly edited the password database and copying the hashes, or they used something like chpasswd -e to supply hashes.

The only bad consequence of repeating a password hash is that it makes it apparent that the accounts have the same password. With distinct salts, as is normally the case, it would be impossible to tell that two accounts have the same password except by guessing the password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.