A part of my /etc/login.defs file looks like this:


# Define the number of SHA rounds.
# If not specified, the libc will choose the default number of rounds (5000).
# The values must be inside the 1000-999999999 range.
# If only one of the MIN or MAX values is set, then this value will be used.
# If MIN > MAX, the highest value will be used.


From what I understand of this, is that the password will go through 6000 rounds of hash.

Now, when I used a tool like hashcat how do I tell it that the hash has gone through 'x' number of rounds.

I am able to use hashcat like so: hashcat -m 1800 -a 0 -o found.txt hash.txt rockyou.txt and it is still able to find it. Is it able to figure out the number of rounds by itself?

Edit: I just found out that the Linux box wasn't actually using 6000 rounds of hash, although I thought I had configured it to use 6000 rounds. Instead it was just 5000.

With some Python code, I was able to replicate the "SHA512" password encryption in Linux:

from passlib.hash import sha512_crypt

The resulting hash is $6$rounds=6000$6EGwX1iP$oMerxGPimb/4ZXcI0Vbt87sNfw07eh7VPzcQwHOls8t3hLYGLQR0KjncrpyAjLTfPC3Fj7jhFoZKeuPRfTbJa/

This string of course has the number of rounds which can be passed to hashcat.

1 Answer 1


Edit: I saw that you found your answer, but I'll add it here for completeness sake. (And I already had this written down).

Hashcat doesn't guess the # of rounds, and the amount of rounds specified in your /etc/login.defs isn't properly applied.

I took an example from my Linux box:


This is the same as:


If the amount of rounds was properly set, you would see a different number instead of 5000 in the hash.


On my box running Kali Linux I was able to specify the number of rounds by going to the /etc/pam.d/common-password and finding the line (line 25 in my case):

password [success=1 default=ignore] pam_unix.so obscure sha512

I appended "rounds=1234" to it:

password [success=1 default=ignore] pam_unix.so obscure sha512 rounds=1234

saved and created a user:

$> adduser test3

And ended up with this in my /etc/shadow-file:

$>tail --lines=1 /etc/shadow



You can manually specify how many iterations Hashcat should do by appending rounds=[# of iterations] after the signature, e.g:


This will, however, be automatically applied if the amount of rounds != 5000, in /etc/shadow

  • Could you give me some pointers to how to correctly apply the number of rounds in '/etc/login.defs' Jul 11, 2015 at 16:34
  • 1
    @user1720897 I've added a part on how to do it in Kali Linux now.
    – Mrtn
    Jul 11, 2015 at 17:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.