Hi there,
There's something I don't understand. The same string does not give the same md5 hash everytime. I wanted to find a way to check someone's password but the following script obviously shows that it's not possible that way :

ks354286:~# user=foo
ks354286:~# pw=$(mkpasswd -H md5 topsecret)
ks354286:~# echo "$user:$pw"
foo:$1$WYq0L220$25QI3T1cMGh1PsJc5guFv1
ks354286:~#
ks354286:~# useradd -p$pw $user
ks354286:~# grep "$user:$pw" /etc/shadow
foo:$1$WYq0L220$25QI3T1cMGh1PsJc5guFv1:14284:0:99999:7:::
ks354286:~#
ks354286:~# pw=$(mkpasswd -H md5 topsecret)
ks354286:~# echo "$user:$pw"
foo:$1$wrSmUGbt$DtqoBPvQ7xImZcHi3F2M71
ks354286:~#
ks354286:~# grep "$user:$pw" /etc/shadow
ks354286:~#

UNIX passwords contain a "salt" in order to create (a bit of) randomness and make them less guessable. To generate a password you usually call the crypt(3) routine with an empty salt. To check a password, you pass the hashed password as the salt to crypt(3), which extracts the salt originally used and uses this to create the other hashed password. If both hashes match, you've got the correct password.

pludi is correct, determining MD5 salt could be based on several things, timestamp that the user was created, last password change, you name it. Determining password is a pain in the butt, you could get some crack utilities like John the Ripper. But if you are the sysadmin of the box, reset the password, or force a password change for the end user.

Being security conscious I don't want a file laying around with passwords in an unencrypted format.. Get a trojan horse have that file stolen and kiss your career goodbye.

Hi pludi,
It took me a while to understand your "chinese". Sorry, I'm not a real pro.
Hi rmuledeer and thanks for your help as well.

Actually, the salt must only be part of the hashed password. The following shows that without salt, the hash is "random" but if you provide a specific one, you get the same hash.

ks354286:~# pw=$(mkpasswd -H md5 topsecret); echo $pw
$1$v2CxH4iz$T/186EWGfcqq9hXOpWKvv1
ks354286:~# pw=$(mkpasswd -H md5 topsecret); echo $pw
$1$akgRfAM.$4vlNIo233jQVM2jc989Ss/
ks354286:~# pw=$(mkpasswd -H md5 -S ${pw:3:8} topsecret); echo $pw
$1$akgRfAM.$4vlNIo233jQVM2jc989Ss/

ks354286:~# user=foo
ks354286:~# password=topsecret
ks354286:~# hpw=$(grep "^$user:" /etc/shadow | cut -d ':' -f 2)
ks354286:~# grep -q "^$user:$(mkpasswd -H md5 -S ${hpw:3:8} $password)" /etc/shadow && echo OK || echo 'Denied!'
OK
ks354286:~#
ks354286:~# password=notsosure
ks354286:~# hpw=$(grep "^$user:" /etc/shadow | cut -d ':' -f 2)
ks354286:~# grep -q "^$user:$(mkpasswd -H md5 -S ${hpw:3:8} $password)" /etc/shadow && echo OK || echo 'Denied!'
Denied!