Comments on: Linux Upgrade Password Hashing Algorithm to SHA-512

By: wedgeshot

wedgeshot — Wed, 07 Apr 2010 14:43:34 +0000

Actually Ubuntu is sha512 in 9.04 and 9.10. I don’t remember changing anything related to PAM so that should be the default

By: Vivek Gite

Vivek Gite — Mon, 11 Jan 2010 04:46:11 +0000

Try kubrick comment # 5, it may work on Ubuntu too…

By: KING SABRI

KING SABRI — Mon, 11 Jan 2010 01:38:00 +0000

Thnaks Vivek

Fedora 12 by Default uses SHA-512
CentOS-5.4 by Default uses MD5
Ubuntu by Default uses MD5, But the command Not Found

By: j0rn

j0rn — Tue, 24 Nov 2009 23:45:59 +0000

nice tip, thx :)
the algorithm corresponds to the second parameter in shadow passwords entries

user:$1$abcdef…

$1$ is md5 while $6$ is sha512, $0$ should be old des and $2$ blowfish I think

man crypt ;)

I updated my local users digest “by hand” by modifying the “ENCRYPT_METHOD” directive directly in login.defs, but I didn’t that -more elegant- way to do

By: Vivek Gite

Vivek Gite — Thu, 12 Nov 2009 13:17:02 +0000

@ iCroc / Philippe

Thanks for pointing out the typo.

@ kubrick,

Thanks for sharing Debian specific information.

By: kubrick

kubrick — Thu, 12 Nov 2009 11:16:53 +0000

I’ve found this little article for Debian based systems.
You could change the default MD5 algorithm for the more secure Blowfish.

On Debian GNU/Linux, switching from the default MD5 algorithm to Blowfish is slightly more work, but still not terribly difficult to accomplish:

First, install the libpam-unix2 module. That can be done simply via APT, Debian’s software management system, using the command
# apt-get install libpam-unix2
Next, edit /etc/pam.d/common-auth, /etc/pam.d/common-account, /etc/pam.d/common-session, and /etc/pam.d/common-password so that in each file you replace pam_unix.so with pam_unix2.so.
Finally, while you are editing the common-password file, change the term md5 so that it reads blowfish instead.

Cheers!

By: Philippe Petrinko

Philippe Petrinko — Thu, 12 Nov 2009 10:56:25 +0000

Hi Vivek,
This is an Interesting post. Thanks for writing it.

BTW, would you modify
# authconfig –passalgo=SHA512 –update

to lowercase “sha512″ as iCroc observed ?

By: iCroc

iCroc — Wed, 11 Nov 2009 22:19:49 +0000

I have solved this problem by replacing this command
authconfig –passalgo=SHA512 –update
to
authconfig –passalgo=sha512 –update

Because no algorithm called SHA512

Best Regards

By: iCroc

iCroc — Wed, 11 Nov 2009 14:29:11 +0000

This message appear

authconfig: Unknown password hashing algorithm specified, using sha256.

By: Andrii

Andrii — Wed, 11 Nov 2009 12:52:45 +0000

Is it works in Debian?