07-25-2014
Problem with password algorithm ssha1
Hello, I have an AIX 6.1 machine and a few months ago i changed the default password algorithm to ssha1 after suggestions of our security department that it is a more secure algorithm to encrypt passwords rather than standard AIX algorithm. I noticed that i am having some problems every now and then with users. It seems that some users enter their correct passwords but the get the message of invalid login. This does not happen to all users just some of them. About a month ago i removed a user that faced the problem and created again. The user was working fine after that and then i got a call again today that she is facing the same problem. Also have in mind that i am using password index as well for users passwords. I dont know if there is any conflict between the index with the ssha1 algorithm or if the issue is something else. It just seems weird. Does anyone has any idea of what might be the problem? Thanks
Moderator's Comments:
|
|
edit by bakunin: there is a specialised board for AIX, i transfer the thread to there.
|
|
Last edited by bakunin; 07-25-2014 at 06:19 AM..
10 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
I get a $ sign - do I put in a password? What do I do? I don't have a password only a user name and an activation ID - what's next? No one will answer me! (1 Reply)
Discussion started by: kaye
1 Replies
2. Programming
Looking for an algorithm to compute the number of days between two given dates I came across a professor's C program located here: http://cr.yp.to/2001-275/struct1.c
I was wondering if anyone could tell me where the value 678882 in the line
int d = dateday - 678882;
comes from and also the... (1 Reply)
Discussion started by: williamf
1 Replies
3. UNIX for Dummies Questions & Answers
Hello,
I am currently trying to execute a command in a Windows machine from a UNIX server. In order to do this, I am using the RSH command in UNIX but whenever i do this I am getting this error "RSHD: <username>: could not retrieve password: Please login and run rsetup."
I log in via the... (0 Replies)
Discussion started by: punyenye
0 Replies
4. Shell Programming and Scripting
Hi all,
In one of my script, somewhere I need to input password of a server when ssh password's prompt comes. I've tried with EOF but it's not taking. I don't want to disable password through ssh. I want the password should be passed with my script. Any suggestion?
Thanks in advance! (2 Replies)
Discussion started by: naw_deepak
2 Replies
5. UNIX for Dummies Questions & Answers
hi All,
i need to connect(sftp) from serverA to serverB via rsa algorithm. But i can not success this.
i did like that:
On ServerA:
#ssh-keygen -t rsa
after running this command, "id_rsa" and "id_rsa.pub" files were generated. i checked.there is private key in id_rsa file and... (8 Replies)
Discussion started by: temhem
8 Replies
6. Solaris
Hi Solaris's expert
I need to change user password on Solaris10 2 servers.
With the same password I can change it just only one.
Try to check everything but not found difference??
password pattern: abcdeFgh9Jk
server1 check all characters but server2 check only first 8 characters.Why??... (10 Replies)
Discussion started by: arm_naja
10 Replies
7. SuSE
I just implemented the MD5 Loadable Password Algorithm on my AIX 5.3
TL 11 systems. I run NIS and authentication is working fine between
AIX boxes. I have one OpenSuse Linux box in NIS and I get a PAM
authentication error when I try to login. If you have an idea on
getting the Linux box... (2 Replies)
Discussion started by: prichard
2 Replies
8. Shell Programming and Scripting
Hello,
trying to download data by the ksh via sftp (password protected). I am looking for the exact syntax. (I know there are 1000 of threads but I have not found anything how to add the password).
ftp.XYZ.com
User:ABC
Passwrd:123
I tried several stuff like:
sftp -b... (2 Replies)
Discussion started by: jurgen
2 Replies
9. IP Networking
Hi,
Whatever I do I can not get password-less ssh working, which I need!
I have tried (which worked using FC8):
On a client node:
ssh-keygen -t dsa -f .ssh/id_dsa
Exit back to the server:
mv id_dsa.pub authorized_keys2
chmod 640 authorized_keys2
Also:
ssh-keygen -t rsa
ssh-copy-id... (6 Replies)
Discussion started by: Bic121
6 Replies
10. AIX
hi to all, i have an AIX6.1 machine and i want to decrypt an ssha1 password written on /etc/security/passwd. the reason that i want to do that is because i have some complains about a few users that cannot login and receive the message for invalid login. i suspect that they are entering wrong... (15 Replies)
Discussion started by: omonoiatis9
15 Replies
LEARN ABOUT XFREE86
chpasswd
CHPASSWD(8) System Management Commands CHPASSWD(8)
NAME
chpasswd - update passwords in batch mode
SYNOPSIS
chpasswd [options]
DESCRIPTION
The chpasswd command reads a list of user name and password pairs from standard input and uses this information to update a group of
existing users. Each line is of the format:
user_name:password
By default the passwords must be supplied in clear-text, and are encrypted by chpasswd. Also the password age will be updated, if present.
By default, passwords are encrypted by PAM, but (even if not recommended) you can select a different encryption method with the -e, -m, or
-c options.
Except when PAM is used to encrypt the passwords, chpasswd first updates all the passwords in memory, and then commits all the changes to
disk if no errors occurred for any user.
When PAM is used to encrypt the passwords (and update the passwords in the system database) then if a password cannot be updated chpasswd
continues updating the passwords of the next users, and will return an error code on exit.
This command is intended to be used in a large system environment where many accounts are created at a single time.
OPTIONS
The options which apply to the chpasswd command are:
-c, --crypt-method METHOD
Use the specified method to encrypt the passwords.
The available methods are DES, MD5, NONE, and SHA256 or SHA512 if your libc support these methods.
By default, PAM is used to encrypt the passwords.
-e, --encrypted
Supplied passwords are in encrypted form.
-h, --help
Display help message and exit.
-m, --md5
Use MD5 encryption instead of DES when the supplied passwords are not encrypted.
-R, --root CHROOT_DIR
Apply changes in the CHROOT_DIR directory and use the configuration files from the CHROOT_DIR directory.
-s, --sha-rounds ROUNDS
Use the specified number of rounds to encrypt the passwords.
The value 0 means that the system will choose the default number of rounds for the crypt method (5000).
A minimal value of 1000 and a maximal value of 999,999,999 will be enforced.
You can only use this option with the SHA256 or SHA512 crypt method.
By default, the number of rounds is defined by the SHA_CRYPT_MIN_ROUNDS and SHA_CRYPT_MAX_ROUNDS variables in /etc/login.defs.
CAVEATS
Remember to set permissions or umask to prevent readability of unencrypted files by other users.
CONFIGURATION
The following configuration variables in /etc/login.defs change the behavior of this tool:
SHA_CRYPT_MIN_ROUNDS (number), SHA_CRYPT_MAX_ROUNDS (number)
When ENCRYPT_METHOD is set to SHA256 or SHA512, this defines the number of SHA rounds used by the encryption algorithm by default (when
the number of rounds is not specified on the command line).
With a lot of rounds, it is more difficult to brute forcing the password. But note also that more CPU resources will be needed to
authenticate users.
If not specified, the libc will choose the default number of rounds (5000).
The values must be inside the 1000-999,999,999 range.
If only one of the SHA_CRYPT_MIN_ROUNDS or SHA_CRYPT_MAX_ROUNDS values is set, then this value will be used.
If SHA_CRYPT_MIN_ROUNDS > SHA_CRYPT_MAX_ROUNDS, the highest value will be used.
Note: This only affect the generation of group passwords. The generation of user passwords is done by PAM and subject to the PAM
configuration. It is recommended to set this variable consistently with the PAM configuration.
FILES
/etc/passwd
User account information.
/etc/shadow
Secure user account information.
/etc/login.defs
Shadow password suite configuration.
/etc/pam.d/chpasswd
PAM configuration for chpasswd.
SEE ALSO
passwd(1), newusers(8), login.defs(5), useradd(8).
shadow-utils 4.5 01/25/2018 CHPASSWD(8)