psswd&shadow 2 passwd together?!!


 
Thread Tools Search this Thread
Top Forums UNIX for Advanced & Expert Users psswd&shadow 2 passwd together?!!
# 15  
Old 09-22-2011
Quote:
Originally Posted by bakunin
This means that every password has one and only one hash value, but not every hash value has exactly one password. Several passwords can have the same hash value.

This might be the case here.
Naturally password hashes have to be surjective, if information wasn't lost you could make an algorithm to convert hashes back to plaintext.

One hash fits more than one password, in theory, but the odds of finding the a second one are very remote. The odds of the second being anything sensible are also remote -- more likely it'd be untypable garbage.

Last edited by Corona688; 09-22-2011 at 02:07 PM..
# 16  
Old 09-22-2011
Tx, guys

I see that hash value (md5) is defenitly different for those password (I replaced actual string for demonstration. So still have same questions why those 2 different length passwords works ?Smilie
Code:
-bash-3.00$ echo -n "passw1" | md5sum
1243543e62447b14aee90ca047e2e330  -
-bash-3.00$ echo -n "password2" | md5sum
45eb34739884655cc54b0c36bd09d50d  -

And here is output from requested files, sorry it took me while to migrate to another system for security reasons.
Code:
bash-3.00$ cat /etc/pam.d/system-auth /etc/nsswitch.conf
# =====================================================================
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      /lib/security/$ISA/pam_env.so
auth        sufficient    /lib/security/$ISA/pam_unix.so likeauth nullok
auth        sufficient      /lib/security/pam_lsass.so      try_first_pass
auth        required      /lib/security/$ISA/pam_deny.so

account     required      /lib/security/pam_lsass.so      unknown_ok
account     sufficient      /lib/security/pam_lsass.so
account     required      /lib/security/$ISA/pam_unix.so
account     sufficient    /lib/security/$ISA/pam_succeed_if.so uid < 100 quiet
account     required      /lib/security/$ISA/pam_permit.so

password    sufficient     /lib/security/pam_lsass.so
password    requisite     /lib/security/$ISA/pam_cracklib.so retry=3
password    sufficient    /lib/security/$ISA/pam_unix.so nullok use_authtok md5 shadow
password    required      /lib/security/$ISA/pam_deny.so

session     required      /lib/security/$ISA/pam_limits.so
session     required      /lib/security/$ISA/pam_unix.so
#

# =====================================================================
# /etc/nsswitch.conf
#
# An example Name Service Switch config file. This file should be
# sorted with the most-used services at the beginning.
#
# The entry '[NOTFOUND=return]' means that the search for an
# entry should stop if the search in the previous entry turned
# up nothing. Note that if the search failed due to some other reason
# (like no NIS server responding) then the search continues with the
# next entry.
#
# Legal entries are:
#
#       nis or yp               Use NIS (NIS version 2), also called YP
#       dns                     Use DNS (Domain Name Service)
#       files                   Use the local files
#       db                      Use the local database (.db) files
#       compat                  Use NIS on compat mode
#       hesiod                  Use Hesiod for user lookups
#       ldap                    Use LDAP (only if nss_ldap is installed)
#       nisplus or nis+         Use NIS+ (NIS version 3), unsupported
#       [NOTFOUND=return]       Stop searching if not found so far
#

# To use db, put the "db" in front of "files" for entries you want to be
# looked up first in the databases
#
# Example:
#passwd:    db files ldap nis
#shadow:    db files ldap nis
#group:     db files ldap nis

passwd:     files lsass
shadow:     files
group:      files lsass

#hosts:     db files ldap nis dns
hosts:      files dns

# Example - obey only what ldap tells us...
#services:  ldap [NOTFOUND=return] files
#networks:  ldap [NOTFOUND=return] files
#protocols: ldap [NOTFOUND=return] files
#rpc:       ldap [NOTFOUND=return] files
#ethers:    ldap [NOTFOUND=return] files

bootparams: files
ethers:     files
netmasks:   files
networks:   files
protocols:  files
rpc:        files
services:   files
netgroup:   files
publickey:  files
automount:  files
aliases:    files

# 17  
Old 09-22-2011
Quote:
Originally Posted by trento17
Tx, guys

I see that hash value (md5) is defenitly different for those password (I replaced actual string for demonstration.)
Try giving md5 only the first eight characters of each Smilie

The hashes in the shadow file aren't direct md5's of passwords, I'm pretty sure. It depends on implementation but usually it's a hash of the password plus a small 'salt' string, to prevent two users with the same password from having identical hashes(and prevent people from just comparing hash keys to big lists of known hashes.)

If your passwords use md5, be aware that md5 has been cracked, and is now considered a poor algorithm. There's software which can generate strings to match a given md5 on command. This doesn't matter unless an attacker has root access to your shadow file though -- in which case you're screwed anyway.

Last edited by Corona688; 09-22-2011 at 03:48 PM..
# 18  
Old 09-22-2011
Thanks, Corona !
It's still different:
my <passwd1> is 7 char long, and <password002> is 11 char.
I tried to md5 all combinations, including <passwd1_> (with space to get 8) they are different. Which is perfectly expected if you feed 7 and 8 chars to md5.

I don't think we have md5 for hashing, I just try to understand how it works.

Tx
# 19  
Old 09-22-2011
Are the first 7 characters the same, then? Do the passwords have any resemblance to each other at all?
# 20  
Old 09-22-2011
Quote:
Originally Posted by trento17
Code:
auth        required      /lib/security/$ISA/pam_env.so
auth        sufficient    /lib/security/$ISA/pam_unix.so likeauth nullok
auth        sufficient      /lib/security/pam_lsass.so      try_first_pass
auth        required      /lib/security/$ISA/pam_deny.so

This system's authentication setup appears to be configured to first try the local passwd file followed by, in case of failure, an active directory domain.

I doubt a hash collision is the problem. More likely, one password is set on the local *nix system and a different one on the domain controller. If local auth fails (pam_unix.so), the password is reused (try_first_pass) by pam_lsass.so.

Regards,
Alister
# 21  
Old 09-22-2011
Thanks Alister so much, that' make some light. Still not sure is it to be a problem or it's fine. Most recent longer password was set thru domain controller.

And first 7 chars are still different in real and in my sample line (diff chars, sequence, numbers vs alpha, etc..). Anyway there is no such think like <password hash is little bit different>
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Supress the psswd from ps in ksh/bash

I am running the ETL job to passing the database username,pssswd positional arguments to shell script (bash) and how can we suppress/hide the password from ps command. (2 Replies)
Discussion started by: pimmit22043
2 Replies

2. Solaris

Passwd -l or -u modifies lastchg field in /etc/shadow file

Hi, I have a Solaris 10 box where password aging is not functioning properly. Using the passwd command with the -l or -u options causes the lastchg field in the /etc/shadow file to be modified. Therefore, if a user's password is set to expire in 90 days and they are 1 day away, all they have... (4 Replies)
Discussion started by: cschar
4 Replies

3. Solaris

Passwd,shadow files deleted and abort sequence disabled

Hi all.. I moved the /etc/shadow and /etc/shadow files to /tmp and then rebooted my PARC machine running 5.10. I did it to see if I could recover from single user mode. But, I forgot to enable the abort key-sequence which I earlier disabled. Stuck! One of my gurus told I had to... (9 Replies)
Discussion started by: satish51392111
9 Replies

4. Solaris

difference between /etc/shadow and /etc/default/passwd

Hi , can anyone explain me the difference between /etc/shadow and /etc/default/passwd . As per my knowledge both the files are used for password aging and control parameters. (2 Replies)
Discussion started by: rogerben
2 Replies

5. Solaris

passwd cmd reenables passwd aging in shadow entry

Hi Folks, I have Solaris 10, latest release. We have passwd aging set in /etc/defalut/passwd. I have an account that passwd should never expire. Acheived by emptying associated users shadow file entries for passwd aging. When I reset the users passwd using passwd command, it re enables... (3 Replies)
Discussion started by: BG_JrAdmin
3 Replies

6. UNIX for Advanced & Expert Users

Converting freebsd (5.2.1) master.passwd to Debian shadow

I'm trying to make this work, and it half works. Accounts with password hashes matching the old crypt(3) algorithm work just fine: JUpfW/w6jo6aw But accounts with longer password hashes preceded by $1$, such as the following, do not work: $1$iIcbppdP$HDyjJeVMGgJ.ovLsnjtTR.... (0 Replies)
Discussion started by: davidstvz
0 Replies

7. Solaris

tool to convert /etc/passwd and etc/shadow

i wonder if there is a tool to read the /etc/passwd or /etc/shadow files in order to reset user accounts to the same one. By moving (restore) all filessytem and data to another same Sun box, none of the users are able to logon to the new box which i didn't change nothing. But if i reset the user... (1 Reply)
Discussion started by: lamoul
1 Replies

8. UNIX for Dummies Questions & Answers

How to : Identify the the password is encrypted or not in /etc/shadow or /etc/passwd?

Thanks AVKlinux (11 Replies)
Discussion started by: avklinux
11 Replies

9. UNIX for Dummies Questions & Answers

is it really not possible for me to edit the etc/group & the etc/passwd files?

From what I have read it possible to create a new group by editing the etc/group and etc/passwd in UNIX two files but a non-experienced user may face many problems such as destroying the file by mistake ot that his changes to these file does not make any difference. However, there is this... (2 Replies)
Discussion started by: whatev3r
2 Replies

10. UNIX for Dummies Questions & Answers

nobody & noaccess entries in passwd file

Hi, I cud find entries for user's named nobody and noaccess in the passwd file in the Unix system in which I am working ... I have seen entries for these in other systems too .... What is the significance for nobody and noaccess ... ?? Anything special ?? Can anyone help ?? Thanks &... (1 Reply)
Discussion started by: Sabari Nath S
1 Replies
Login or Register to Ask a Question