Understanding how linux openssl passwords work

Question

I'm trying to understand how Linux hashes their passwords, so to get started lets say I do this openssl passwd -1 -salt xyz test. This will output: $1$xyz$jAlmRpcFe.aiPOIXET9GG/. Now what I do understand:

• $1$ is the md5 algorithm
• xyz$ is the salt used with a $ sign appended to it
• jAlmRpcFe.aiPOIXET9GG/ is the actual password hashed with md5 and something else.

The last part is what I do not understand, what else is this hashed computed with?

Answer 1

As wikipedia says

Poul-Henning Kamp designed a baroque and (at the time) computationally expensive algorithm based on the MD5 message digest algorithm. ...
First the passphrase and salt are hashed together, yielding an MD5 message digest. Then a new digest is constructed, hashing together the passphrase, the salt, and the first digest, all in a rather complex form. Then this digest is passed through a thousand iterations of a function which rehashes it together with the passphrase and salt in a manner that varies between rounds. The output of the last of these rounds is the resulting passphrase hash.

That's tells you it's not just doing a (single) hash of pw+salt, but it isn't very exact. Fortunately OpenSSL is open source, so https://github.com/openssl/openssl/blob/master/apps/passwd.c#L322 (or apps/passwd.c in any copy of any version of the source which has been available for decades) shows you the exact algorithm. It is indeed baroque, more so than I care to try to explain unless you have a specific question about it.