Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In a legal, learning context at school, we have to understand security in Linux in the /ect/shadow file and the anaconda-ks.cfg.

These two files contains often different kind of hash and the password of often hashed as:


In my exemple, I have something like $1$8CharsSalt$22CharsHash

I understand it's a MD5 hash using the the 8 chars salt and using a base 64 encoded hash.

I have two questions about these lines.

My first one: Is the salt in clear format (in /etc/shadow in Linux). I am pretty sure that the answer is yes, but I just want to confirm.

My second one: using a password cracker tool like John the Ripper, I paste the line above (the real hashes) and it detected It was FreeBSD MD5 [32/64]. I see what John is trying, but, is he using the 8 chars salt of the pasted line?

share|improve this question
up vote 2 down vote accepted
  1. Yes, it's just a base64 encode of the salt.
  2. Yes, all UNIX/UNIX-based systems have some standardisation of their user databases and functions. FreeBSD was the first variant to use MD5 and encode is in the UNIX scheme of $algo$salt$hash base64 encoding the salt and the hash parts. Linux uses it in an identical way if md5 is being used (unlikely on new Linux systems).
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.