I need to manually edit
/etc/shadow to change the root password inside of a virtual machine image.
Is there a command-line tool that takes a password and generates an
/etc/shadow compatible password hash on standard out?
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
You can use following commands for the same:
openssl passwd -6 -salt xyz yourpass
-1 will generate an MD5 password,
-5 a SHA256 and
-6 SHA512 (recommended)
mkpasswd --method=SHA-512 --stdin
As @tink suggested, we can update the password using
echo "username:password" | chpasswd
Or you can use the encrypted password with
chpasswd. First generate it using this:
perl -e 'print crypt("YourPasswd", "salt", "sha512"),"\n"'
Then later you can use the generated password to update
echo "username:encryptedPassWd" | chpasswd -e
The encrypted password we can also use to create a new user with this password, for example:
useradd -p 'encryptedPassWd' username
On Ubuntu 12.04, there is mkpasswd (from the whois package): Overfeatured front end to crypt(3)
mkpasswd -m sha-512 -S saltsalt -s <<< YourPass
-m= Compute the password using the TYPE method. If TYPE is help then the available methods are printed.
-S= salt used.
$ mkpasswd -m help -s = Read password from stdin
This solution has the following benefits:
Nothing additional to install
Does not store the password in your shell history
Generates a random salt for you
Uses a modern, strong hashing algorithm, SHA-512
Re-prompts for the password to avoid mistakes.
$ python3 -c "from getpass import getpass; from crypt import *; \ p=getpass(); print('\n'+crypt(p, METHOD_SHA512)) \ if p==getpass('Please repeat: ') else print('\nFailed repeating.')"
Edit: With the deprecation of the
crypt module in Python 3.13, the following snippet can be used:
import os, base64, ctypes, getpass salt = base64.b64encode(os.urandom(16), altchars=b"./").rstrip(b"=") crypt = ctypes.CDLL("libcrypt.so.2").crypt crypt.restype = ctypes.c_char_p p=getpass.getpass() if p==getpass.getpass("Please repeat: "): print("\n"+crypt(p.encode(), b"$6$"+salt).decode()) else: print("\nFailed repeating.")
it generates a random salt encoded to respect the
[./0-9A-Za-Z] alphabet (B64, not to be mistaken with base64), loads the system
crypt library (which the Python
_crypt module is using) and call it's
crypt function specifying the
$6$ format (SHA512) plus the
salt to compute the entry.
However, OpenSSL often present on systems and providing a
passwd command, seems to include newer algorithms since v1.1.1, so this might be easier to use.
For example (
-6 here indicates algorithm 6, which is SHA512 ; salt is generated automatically):
$ openssl passwd -6 Password: Verifying - Password: $6$BIAw/F3wLlH4qofD$2dqhHKfCZNuLScGHKFdkEBmCwtTpInOZSwglqCAAeWgDVM7duqCZLJU69/Ie2LZHJMqUeT7mbx/.HLNrH50mk1
Be careful however with the
-salt argument, because it doesn't allow empty salt and allows invalid values in the salt (like
None of the current methods are acceptable to me - They either pass the password on the command line (which ends up in my shell's history), require the installation of additional utilities (
makepasswd), use hard-coded salts or use old hashing techniques.
This method would generate SHA-512 hashes after prompting for the password and would use a random salt.
A method utilising Python 2 without any non-standard libraries:
python2 -c 'import crypt, getpass,os,base64; print crypt.crypt(getpass.getpass(), "$6$"+base64.b64encode(os.urandom(16))+"$")'
To do it without a prompt: (This will leave your password in the command history)
python2 -c 'import crypt, os,base64; print crypt.crypt("MyPassword", "$6$"+base64.b64encode(os.urandom(16))+"$")'
chpasswd -e pair didn't work in my case in RHEL6. Combining
openssl passwd and
usermod -p command did the job.
Generate the hash value of the password along with the salt value:
$ openssl passwd -1 -salt 5RPVAd clear-text-passwd43 $1$5RPVAd$vgsoSANybLDepv2ETcUH7.
Then, copy the encrypted string to usermod. Make sure to wrap it with single quotes.
$ usermod -p '$1$5RPVAd$vgsoSANybLDepv2ETcUH7.' root
Check it out in shadow file.
$ grep root /etc/shadow root:$1$5RPVAd$vgsoSANybLDepv2ETcUH7.:17774:0:99999:7:::
Expanding a bit on the criticisms of u150825 and Gert van den Berg, I found myself needing something relatively flexible for different situations with different automation systems. I decided I would add to my own little library of useful scripts and write this. It uses only native libraries from python 2.7+, and works on python3 just as well.
You can pick it up here if you like. It's just as easy to drop this in your environment if you're needing to use it a lot, http hosted or whatever, and you can run it on any platform using whatever the default python interpreter you've got available to you is, pretty reliably counting on it working.
It defaults to prompting using getpass with prompts on stderr (allowing easy capture of stdout), but if you pipe a string to it it'll just reap from stdin. Depending on how you're going about this, it may not be showing up in command history, either, so just be cognizant of what it is you're working with. I like having a flexible tool that'll behave in an expected way, rather than having to rely on packages or python one-lining my way to victory 10 different ways.
As many commenters have pointed out. Specifying your salt, let alone your password, is a security problem, because it makes reusing salts possible. Reuse of salts makes rainbow table attacks on your password hashes much more feasible, and it also makes it obvious which users share passwords with each other (isolating and highlighting likely less secure passwords such as 123456 or qwertyuiop).
You should not specify your password on the command line (because it is saved in shell history, and even if it's deleted, it could still reside for some time in the free space of your disk, especially if you're using a COW filesystem). You should not manually specify your salt at all. You can achieve this by simply using:
openssl passwd -6
-6 specifies SHA512. Use
-5 for SHA256. Avoid
-1 for MD5, if possible.)
OpenSSL will ask you for your password via stdin twice, and generate a random salt for each input.
Currently, I don't have enough reputation to comment.I created this password generator tool . It uses method no 1 described by Rahul Patil.