1

Background

  • As an experiment, I was adding new users (as the root user) by manually creating entries into /etc/passwd. To hash the passwords I was using openssl, in particular OpenSSL 1.1.1g but the result should be the same across versions.

  • I noticed each time I hashed the string "testing" I would get a different result.
    # openssl passwd testing YY9E0oGqqamCM # openssl passwd testing csL9dpD2Iy3H2

  • I then added both hashes to the /etc/passwd file like so:
    # echo "root2:YY9E0oGqqamCM:0:0:root:/root:/bin/bash" >> /etc/passwd # echo "root3:csL9dpD2Iy3H2:0:0:root:/root:/bin/bash" >> /etc/passwd

  • Finally, I switched to each user successfully, despite their hashes being different:
    $ whoami reguser
    $ su root2 Password: testing
    # whoami root # exit
    $ whoami reguser
    $ su root3 Password: testing
    # whoami root

Question

  • How is it that I am able to use the same password (i.e. testing) even though the actual hashes within the /etc/passwd file are different?
    • It would be great if someone could explain what is going on behind the scenes that allows this to work.
      • I assume that the string "testing" is being given a different salt each time it is hashed, but how does linux know what that corresponding salt is when my password is entered to switch users?
Improve this question

2 Answers 2

Reset to default
2

Password hashes are usually salted. If you do not specify the salt then it is generated randomly. Thus the results differ. The salt is part of the output:

openssl passwd -salt xx foo
xxY8K1xpBNqPg

openssl passwd -salt xx foo
xxY8K1xpBNqPg
Improve this answer
4
  • Right. I understand that much. But that doesn't explain how linux knows which random salt to use when attempting to match the hashes of the user input and the stored hash... are the random salts stored somewhere aside from /etc/passwd or is there a clue as to what the random salt was used in the stored hash?
    – BitWrecker
    Commented Nov 21, 2021 at 2:42
  • @BitWrecker Of course, it does. /etc/passwd stores the command output, not just the hash.
    – Hauke Laging
    Commented Nov 21, 2021 at 2:49
  • OHHH I see what you mean... So when using openssl passwd only the first 2 chars are the salt (the max salt length is 2) so the first 2 chars of the hash entry in /etc/passwd is the salt.
    – BitWrecker
    Commented Nov 21, 2021 at 3:57
  • @BitWrecker The fixed length is for the Unix crypt function only. All(?) of the others have a salt with variable length, determined by the surrounding $s.
    – Hauke Laging
    Commented Nov 21, 2021 at 5:20
0

  • The first two chars in the hash entry are the salt. openssl passwd must have a salt and it will always be 2 chars long, no more, no less.

  • So in the case of YY9E0oGqqamCM and csL9dpD2Iy3H2, YY and cs are the respective salts.

    $ openssl passwd -salt YY testing
YY9E0oGqqamCM
$ openssl passwd -salt cs testing
csL9dpD2Iy3H2
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .