By default, Solaris uses Traditional DES to encrypt password hashes in the shadow file.
Is there a way to harden the security by changing this default behaviour and make it to be hashed using a stronger algorithm?
Add a comment
|
1 Answer
You can choose the algorithm used between one of these (older Solaris releases might not have all of them available):
- Traditional Unix crypt
- BSD/Linux compatible md5
- Blowfish
- SHA256
- SHA512
To change the algorithms accepted for existing passwords and used for new ones, modify the CRYPT_ALGORITHMS_ALLOW and CRYPT_DEFAULT variables in /etc/security/policy.conf file.
This is based on plugins so should you want custom encryption methods, you can install third party ones or develop your own.
-
1I assume the SHA and BSD/Linux compatible MD5 algorithms are also used in a UNIX crypt() fashion? So they don't just hash, but also salt and stretch?– chrisNov 20, 2011 at 12:30
-
I would say they do it from reading the source code: cvs.opensolaris.org/source/xref/onnv/onnv-gate/usr/src/lib/…– jlliagreNov 20, 2011 at 22:00
-
dropsafe.crypticide.com/article/1389 is a blog post from one of the co-authors of the Solaris enhanced crypt() (as well as the classic Crack password cracker) with more implementation details.– alancAug 19, 2012 at 1:36