3

recently upgraded debian server with many users to a recent version. The old server used MD5 password hashes (the shadow passwords begin with $1$) and new one is configured to use SHA-512. I want to migrate users from one server to another.

Is there any way to allow both MD5 and SH512 hashes in /etc/shadow? Of course I need MD5 hashes just to allow old users to login until they change password and get SHA512 hash.

I'd prefer to keep using sha512, but would like the old users to be able to partially login once with their old password and then be forced to update their password. Right now, the old md5-based passwords in /etc/shadow won't let the user login at all (and just appear to be incorrect passwords).

Any help?

Improve this question

1 Answer 1

Reset to default
3

Add the following line to your /etc/pam.d/passwd

password        required        pam_unix.so md5,sha512  shadow nullok rounds=65536

Then regenerate your password.

sudo passwd $USER

NB: See Collision vulnerabilities

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .