0

My goal

I have an old MySQL database with usernames and passwords hashed using sha256. I don't have the original passwords and it is not possible to learn them. This is a simple user migration from a database to a Linux system. I need to create all those users on linux, because that linux authentication will be used in other part, and we don't want to make users create credentials again.

My thoughts so far

I have seen that you can use crypt to generate that strange base64 format that uses the shadow file, but that requires the original password. I understand the process is like this in Linux:

  1. Generate a simple sha512 hash based on the salt and password
  2. Loop 1000 5000 times, calculating a new sha512 hash based on the previous hash concatenated with alternatingly the hash of the password and the salt. Additionally, sha512-crypt allows you to specify a custom number of rounds, from 1000 to 999999999
  3. Use a special base64 encoding on the final hash to create the password hash string.

Ref: https://www.vidarholen.net/contents/blog/?p=33

Since the first step is generating the hash with the salt, I think it should be possible. Since linux is open source I believe I could try to get the source code of crypt somewhere like this https://code.woboq.org/userspace/glibc/crypt/crypt-entry.c.html and start in step 2, but before doing all that I don't know if it will work out, I was wondering if there is an easier way. If there is not, where could I get the correct source code of linux for doing that? I am not sure if the link I provided is correct.

Thanks a lot.

Improve this question
4
  • "This is a simple user migration from a database to a linux system". with this I mean more specifically that I have a mysql database with users and the hash of their password. I need to create all those users on linux, because that linux authentication will be used in other part, and we don't want to make users create credentials again.
    – Sfp
    Dec 22, 2020 at 17:31
  • This is an XY problem: It looks like your goal is relatively easy. But you are asking how to do it the hard way. Well done for coming up with a partial solution, however there is a probably a better way. To avoid pain strip you question to the essentials. Start with your goals. You can add what you have tried after.
    – ctrl-alt-delor
    Dec 22, 2020 at 18:22
  • You could try to crack the passwords using john the ripper or some similar tool. I've had to do this in the past to migrate old systems to new and it was quite revealing just how many passwords were crackable. You might not get them all, but the ones you do get would be much easier to import into the new system.
    – mikem
    Dec 22, 2020 at 19:01
  • Did the database use a salt? Do you know the salt that was used. Do you know if a hash count was used and it's value? Is moving from SHA256 to SHA512 a requirement or could you just stick with SHA256? I ask these questions because maybe you have all the information you need to move your existing hash into a linux shadow style entry.
    – DericS
    Dec 22, 2020 at 21:16

2 Answers 2

Reset to default
2

No, sorry, you can't use the old hash directly to generate the new one.

For one, you're talking about having the SHA-256 hash, and then using that to calculate a SHA-512 based hash, which won't happen without inverting the SHA-256 hash. Second, even if you were to use the crypt algorithm based on the same hash ($5$ for the SHA-256 based crypt), pretty much the first step in your link is still "Start by computing the Alternate sum, sha512(password + salt + password)", and for that, you need the plaintext password.

The way to make the transition from one password hash to another work, is to either force your users to refresh their passwords in some way that lets you generate the new hashes; or more nicely, modify the login routine so that it accepts a login against the old hash if the new one doesn't exist, and at the same time generates the new hash. That way you can eventually retire the old hashes, except for accounts that are forgotten.

Improve this answer
3
  • I think this is correct, I didn't look at that part and I believed only in the first part which didn't say anything about calculating sha512(password + salt + password)
    – Sfp
    Dec 22, 2020 at 18:53
  • @Samuel, mm, yes. And it actually says "password" twice, I didn't even realize that. But even if it were just sha512(password + salt), it would only seem to help if the old hash already had a sensible random salt, and there was no issue with padding difference or whatever. But then the md5-crypt and sha-crypt algorithms are just weird and the plain password or at least it's length does seem to appear later in the algorithm, too.
    – ilkkachu
    Dec 22, 2020 at 19:46
  • @Samuel, technically, I suppose what you could do, would be to take the old hashes you have, and use them as the password to be processed with sha-crypt (possibly after encoding them in text, either Base64 or hex). So, hash = shacrypt(salt, hex(sha256(password))) . You'd need some frontend to do the initial hash and encode before calling sha-crypt, of course. The step of taking a raw SHA-256 of the hash shouldn't be an issue, since most human passwords have way less than 256 bits (or even 128 bits) of entropy. However, you really should ask on crypto.SE or security.SE before that!
    – ilkkachu
    Dec 22, 2020 at 19:52
-1

There are ways to do it: You probably don't need to compile your own code.

Look into PAM. It is a modular authentication manager. It is used on many many Gnu/Linuxes. There is probably a module that will allow you to use the existing hashes.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .