Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

By default, Solaris uses Traditional DES to encrypt password hashes in the shadow file.

Is there a way to harden the security by changing this default behaviour and make it to be hashed using a stronger algorithm?

share|improve this question

1 Answer

up vote 1 down vote accepted

You can choose the algorithm used between one of these (older Solaris releases might not have all of them available):

  • Traditional Unix crypt
  • BSD/Linux compatible md5
  • Blowfish
  • SHA256
  • SHA512

To change the algorithms accepted for existing passwords and used for new ones, modify the CRYPT_ALGORITHMS_ALLOW and CRYPT_DEFAULT variables in /etc/security/policy.conf file.

This is based on plugins so should you want custom encryption methods, you can install third party ones or develop your own.

share|improve this answer
1  
I assume the SHA and BSD/Linux compatible MD5 algorithms are also used in a UNIX crypt() fashion? So they don't just hash, but also salt and stretch? – chris Nov 20 '11 at 12:30
I would say they do it from reading the source code: cvs.opensolaris.org/source/xref/onnv/onnv-gate/usr/src/lib/… – jlliagre Nov 20 '11 at 22:00
dropsafe.crypticide.com/article/1389 is a blog post from one of the co-authors of the Solaris enhanced crypt() (as well as the classic Crack password cracker) with more implementation details. – alanc Aug 19 '12 at 1:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.