1

By default, Solaris uses Traditional DES to encrypt password hashes in the shadow file.

Is there a way to harden the security by changing this default behaviour and make it to be hashed using a stronger algorithm?

1 Answer 1

2

You can choose the algorithm used between one of these (older Solaris releases might not have all of them available):

  • Traditional Unix crypt
  • BSD/Linux compatible md5
  • Blowfish
  • SHA256
  • SHA512

To change the algorithms accepted for existing passwords and used for new ones, modify the CRYPT_ALGORITHMS_ALLOW and CRYPT_DEFAULT variables in /etc/security/policy.conf file.

This is based on plugins so should you want custom encryption methods, you can install third party ones or develop your own.

3
  • 1
    I assume the SHA and BSD/Linux compatible MD5 algorithms are also used in a UNIX crypt() fashion? So they don't just hash, but also salt and stretch?
    – chris
    Commented Nov 20, 2011 at 12:30
  • I would say they do it from reading the source code: cvs.opensolaris.org/source/xref/onnv/onnv-gate/usr/src/lib/…
    – jlliagre
    Commented Nov 20, 2011 at 22:00
  • dropsafe.crypticide.com/article/1389 is a blog post from one of the co-authors of the Solaris enhanced crypt() (as well as the classic Crack password cracker) with more implementation details.
    – alanc
    Commented Aug 19, 2012 at 1:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .