Comments (6)
Because that's not the salt but the algorithm parameters. The salt is after it.
from whois.
0 means that this is not supported. It is not completely trivial to pass the yescrypt salt to crypt(3) because generating the parameters string for it cannot be done by mkpasswd itself.
I cannot remember if there is a reasonable solution, but I welcome discussions on how to implement this.
from whois.
As user I got confused by this behaviour as well and assumed a bug. Now that I know it's not, I'm curious:
- Am I right that a random salt is automagically generated and used?
- If so, where does the salt come from? Is this randomly generated by lib(x)crypt?
- Are there any differences whether libcrypt or libxcyprt is used?
- And most importantly: has this behaviour any impact on security?
Background:
I'm looking for a way to use yescrypt over SHA-512 for password encryption in my Fedora kickstart files. I found besser82/libxcrypt#64. Luckily mkpasswd is available in Fedora nowadays, but I encountered this not-a-bug. As far as I understand, mkpasswd can be build using libcrypt or the modern libxcrypt [1] but is using the first on Fedora [2]
[1]
Lines 38 to 44 in 41b3435
[2]
$ head -2 /etc/os-release
NAME="Fedora Linux"
VERSION="37 (Thirty Seven)"
$ ldd /usr/bin/mkpasswd
linux-vdso.so.1 (0x00007fffa07f1000)
libcrypt.so.2 => /lib64/libcrypt.so.2 (0x00007f9e3d381000)
libc.so.6 => /lib64/libc.so.6 (0x00007f9e3d1a4000)
/lib64/ld-linux-x86-64.so.2 (0x00007f9e3d3e3000)
from whois.
In my case, the salt seems to be always j9T
(the hash starts with $y$j9T$
). I have tested this on Fedora 38 using mkpasswd -sm yescrypt <<< 'asdf'
and using docker run --rm quay.io/coreos/mkpasswd -sm yescrypt <<< 'asdf'
(based on the Fedora CoreOS docs).
I think using one salt only (of three-byte length) is less secure than providing a custom, possibly much longer salt.
from whois.
🤦♂️ You’re right! I have missed the dollar sign after it. Thanks!
Anyway, how would you verify a hash matches a particular password if you can’t provide the salt? 🤔 Using an expernal program?
from whois.
It is not completely trivial to pass the yescrypt salt to crypt(3) because generating the parameters string for it cannot be done by mkpasswd itself.
I cannot remember if there is a reasonable solution, but I welcome discussions on how to implement this.
In the shadow file there is also the algorithm parameters bit (e.g. j9T
in the below sample shadow entry for password foobar
). So I guess the mkpasswd
would need to support an additional CLI parameter for user to provide parameters for some methods. Or the -m
param could be updated to support a new structure where parameters can be passed along with the method (e.g. yescrypt:j9T
or $y$j9T$
or something).
testpw:$y$j9T$GlmttU6wcxDgSj5vHoHdd.$s62VqHooKXZKns1/eO.Qqn3Wh8PHyS5Ao71Dcyn0SgA:19599:0:99999:7:::
I only looked into this casually today, but found a couple helpful SO answers that cover some detail on generating the required parameters for scrypt
($7$
) and yescrypt/scrypt-variable
($y$
)...
...obviously that isn't a solution, but if I (or someone else) gets around to picking up fixing this...those might be a good point to start in terms of understanding what needs to be done.
Use case here is in devops environment where want to enforce setting passwords to certain values (automated) but do not want to set them over and over and over again...because we track number of changes made on each box as a metric. So need a method to check a known/expected password against shadow and then change or not change depending on whether it was already set. Currently we use mkpasswd
for this which works fine for sha256/512 but not yescrypt which is the new default for shadow in lots of places.
(Yeah yeah yeah, normally we only use publickey and disallow remote password logins...or intentionally lock ourselves out of the boxes after provisioning...but sometimes we have a case where we can't avoid passwords.)
from whois.
Related Issues (20)
- The ip_del_list file has old information HOT 3
- What's going wrong here? HOT 2
- nic.ch queries issue HOT 2
- mkspasswd scrypt method fails when specifying number of iterations HOT 2
- RFE: please start making github releases HOT 5
- .ye WHOIS Server
- 5.5.19 doesn't build with clang HOT 3
- .gn WHOIS Server HOT 1
- whois --version reports illegal option on Solaris 11.4 compiled with GCC HOT 2
- Update license years HOT 1
- 5.5.20: parallel build fails HOT 1
- Was 5.5.20 retagged? HOT 1
- Harmless memory leak in split_server_port() HOT 2
- Network is unreachable for .SE domains HOT 1
- Enhancing WHOIS Tool Accuracy for Exotic Domains through IANA Server Integration HOT 2
- Segfault with --no-recursion on non-existent domain HOT 1
- Compiling on macos threw error, fixed it with gpt
- .AD whois server HOT 2
- .gq now "has no whois server" HOT 3
- No match for "WEB.SALESWIRABJM.COM". HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from whois.