8

Linux typically stores user names and password hashes in /etc/passwd or /etc/shadow.

Now lets say I have an old CentOS distro and I want to attempt to recover a user's password (it's in a legal, learning context at school) encrypted with DES, I figured I would need a plaintext and a cipher encrypted using the same key as my unknown password, crack said key, then decrypt the cipher stored for said user (right?).

Now, my question is, how/when does Linux generate keys when creating users? Could I assume the key used to be the same if I juste created a new user? If so, is the key used by the system just plain recoverable?

3 Answers 3

7

In DES-based scheme salted password is a key, and plaintext is all zeroes, therefore it is not encryption, as key and message roles are swapped.

You can start with Wiki or crypt() man pages to read more about crypt() function:

http://en.wikipedia.org/wiki/Crypt_%28Unix%29

http://www.kernel.org/doc/man-pages/online/pages/man3/crypt.3.html

1
  • Thanks a lot, that makes a lot of sense. It also explains how bruteforce tools try to break DES-based password hashing schemes.
    – anthonyvd
    Oct 15, 2012 at 0:11
9

The passwords aren't encrypted, they're hashed. It is mathematically impossible to derive the original password from the hash. Verification is done by hashing the password that the user enters and comparing it to the one in the vault. If they match, the user is authenticated and they can log in.

7
  • DES is a crypt function though, not a hash, so how does that work?
    – anthonyvd
    Oct 14, 2012 at 19:00
  • 1
    DES also hasn't been used by default on a Red Hat system since the 1990s, if ever. At minimum, a real system probably has MD5 hashed passwords. RHEL 6 switched to SHA-512 hashed passwords by default. Oct 14, 2012 at 19:08
  • The system in question is like a CentOS 2, it IS really old. Hence the question about DES
    – anthonyvd
    Oct 14, 2012 at 19:19
  • 3
    @pwny Older *nix systems used crypt, which uses a DES-based hash scheme. The password is used to form a key, which is then used to encrypt an all-zero block. (Source)
    – Polynomial
    Oct 14, 2012 at 21:49
  • 1
    @this.josh No, that's not a mathematical derivation. It's possible to hash a large number of passwords and compare the results, but it's impossible to derive the original password directly from the hash.
    – Polynomial
    Oct 15, 2012 at 6:11
2

By default Linux uses SHA512 (hashed password starting with $6$) to hash user password.

The following hash algorithms are supported by crypt():

          ID  | Method
          ─────────────────────────────────────────────────────────
          1   | MD5
          2a  | Blowfish (not in mainline glibc; added in some
              | Linux distributions)
          5   | SHA-256 (since glibc 2.7)
          6   | SHA-512 (since glibc 2.7)

To change Linux hash algorithm by default you should edit ENCRYPT_METHOD variable in /etc/login.defs file or you can use authconfig program.

Bruteforce is the only way to crack password hash. If you are searching for cracking tools look at JohnTheRipper or oclhashcat.

2
  • 1
    "Bruteforce is the only way to crack password hash." No, please see security.stackexchange.com/questions/379/…
    – this.josh
    Oct 15, 2012 at 6:00
  • 3
    It is still an advanced way of bruteforce attack. The password is being changed one by one from hashed values. It takes less time but still is an iteration over a known values of ahead prepared passwords.
    – insider
    Oct 15, 2012 at 9:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.