A part of my /etc/login.defs file looks like this:


# Define the number of SHA rounds.
# If not specified, the libc will choose the default number of rounds (5000).
# The values must be inside the 1000-999999999 range.
# If only one of the MIN or MAX values is set, then this value will be used.
# If MIN > MAX, the highest value will be used.


From what I understand of this, is that the password will go through 6000 rounds of hash.

Now, when I used a tool like hashcat how do I tell it that the hash has gone through 'x' number of rounds.

I am able to use hashcat like so: hashcat -m 1800 -a 0 -o found.txt hash.txt rockyou.txt and it is still able to find it. Is it able to figure out the number of rounds by itself?

Edit: I just found out that the Linux box wasn't actually using 6000 rounds of hash, although I thought I had configured it to use 6000 rounds. Instead it was just 5000.

With some Python code, I was able to replicate the "SHA512" password encryption in Linux:

from passlib.hash import sha512_crypt

The resulting hash is $6$rounds=6000$6EGwX1iP$oMerxGPimb/4ZXcI0Vbt87sNfw07eh7VPzcQwHOls8t3hLYGLQR0KjncrpyAjLTfPC3Fj7jhFoZKeuPRfTbJa/

This string of course has the number of rounds which can be passed to hashcat.

1 Answer 1


Edit: I saw that you found your answer, but I'll add it here for completeness sake. (And I already had this written down).

Hashcat doesn't guess the # of rounds, and the amount of rounds specified in your /etc/login.defs isn't properly applied.

I took an example from my Linux box:


This is the same as:


If the amount of rounds was properly set, you would see a different number instead of 5000 in the hash.


On my box running Kali Linux I was able to specify the number of rounds by going to the /etc/pam.d/common-password and finding the line (line 25 in my case):

password [success=1 default=ignore] pam_unix.so obscure sha512

I appended "rounds=1234" to it:

password [success=1 default=ignore] pam_unix.so obscure sha512 rounds=1234

saved and created a user:

$> adduser test3

And ended up with this in my /etc/shadow-file:

$>tail --lines=1 /etc/shadow



You can manually specify how many iterations Hashcat should do by appending rounds=[# of iterations] after the signature, e.g:


This will, however, be automatically applied if the amount of rounds != 5000, in /etc/shadow

  • Could you give me some pointers to how to correctly apply the number of rounds in '/etc/login.defs' Jul 11, 2015 at 16:34
  • 1
    @user1720897 I've added a part on how to do it in Kali Linux now.
    – Mrtn
    Jul 11, 2015 at 17:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .