8

I have a hashed password $6$salt$hash. I want to ssh to a linux server with this hash. How could I do that? Do I need to change cipher spec? Is that possible?

  • 13
    Why do you want to do that? Are you trying to achieve passwordless login (for which you should be using keys?) – pjc50 May 3 at 10:00
  • 3
    Is there any reason to not be using SSH keys instead? Public key - private key approach. Seems to accomplish the same goal (not having raw password on the wire). Not trying to be "that guy" that answers "How to do X" with "Don't do X, do Y", but it seems a strictly better approach. – Captain Man May 3 at 17:44
  • 12
    If you're passing a "hash" then the hash is the password – Richard Tingle May 3 at 20:11
  • There are techniques to authenticate with a password without the server needing to know your password, but SSH unfortunately does not use them, to the best of my knowledge. – forest May 4 at 0:42
43

You will not be able to do that.
The password is verified by the SSH server (or better by PAM library or similar authentication backend on other platform) by taking the received password, hashing it and comparing it to the stored hashed one. There is no way to bypass this process and make the server use the hash directly for comparison.

  • 46
    If you could do this, the consequences would be very bad. If anyone got a hold of your hashed passwords they can just enter them and login. – FireCubez May 3 at 13:42
  • 3
    Well, you could I suppose - your password just becomes the hash. – Boris the Spider May 4 at 17:59
5

I'm going to go out on a limb and guess that this is part of a penetration testing training programme. In which case, you can't get into the system using that hash directly, but you can pass that hash to a cracking programme, such as HashCat, which will attempt to crack the password it represents (and is much faster than online brute force).

If it's for a penetration testing training programme, the password will likely be something easily cracked, such as the "enterprise standard" password of "Password123!".

  • 1
    My guess isn't a total stab in the dark - I had a quick spy at some of the OP's other questions, and they seem to be working through some pen testing training materials. We do all have to start somewhere, so it's good to ask questions. But based on my experience of the industry, I wouldn't be at all surprised if the OP is out on a client site two weeks from now, as a "trained pen tester", so you may be right to weep. – James_pic May 5 at 9:16
-4

I agree with Steffen that the server will store a hash of the 'password' and verify your password by hashing it and seeing if it matches the stored value. However, I don't see why you couldn't be storing a hash of the hash resultant of the password in the server and hash the password on your side before passing it to the server.

The server would hold only: Hash(Hash(Password))
and you would be required on your side to pass: Hash(Password)

I am sure, depending on how secure your side is, this is at least a little more time consuming from a cybersecurity measure for an attacker to crack the password if taken from server side or via transmission, but cumbersome.

  • 2
    OP wants to gain access to the server using the hashed password, he can't change the password on the server to Hash(password). This wouldn't work very well as a way of strengthening the password either, as OP would need to keep track of the salt, he'd be better off just using a better password. – AndrolGenhald May 3 at 14:39
  • 1
    I agree that it wouldn't be the best solution, especially after hashing hashes has the potential to dilute the hash. I was just trying to think of a way to allow him to hash the password before transmission. – J. Doe May 3 at 15:57
  • 1
    "Diluting the hash" isn't a concern, the concern is that the hash essentially becomes the password, and it's much easier to just remember a better password in the first place. SSH already supports public key authentication anyway if you don't like sending your password to the server. – AndrolGenhald May 3 at 16:41
  • @AndrolGenhald Well, "diluting the hash" is still a concern. – wizzwizz4 May 3 at 20:19
  • @wizzwizz4 Not if it's only a couple of hashes, or if it's a proper KDF that includes the salt in each iteration. – AndrolGenhald May 3 at 20:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.