Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

How do you figure out where are user's passwords stored, for users that can login? I know the system is using LDAP for users (username, home path, etc.), but it doesn't contain any kind of passwords. I have access to a configured machine, so how do I figure out where are passwords? (which config file?)

share|improve this question
    
Are you talking about the user login passwords or the user's saved passwords and keys ? –  Capt.Nemo Jun 21 '11 at 22:11
    
User login passwords –  redman Jun 21 '11 at 22:15
    
If you are using LDAP then that should also be where the passwords are stored. Normally they just go in /etc/shadow though. –  psusi Jun 21 '11 at 22:23
    
Yes it's LDAP. I see user's profile (with ldapsearch) but password is not there... –  redman Jun 22 '11 at 8:02
    
you probably don't have access to read it. –  psusi Jun 22 '11 at 13:48

3 Answers 3

Passwords aren't stored themselve. They are transformed by a function, and the so produced value, which is called hash, is stored.

If you login, the same function is performed on your input, and the generated value compared with the one in the stored value in the /etc/shadow file.

The function is of a kind, which is hard to invert. So with the value in /etc/shadow, you can not calculate the original password, and the key in there is not helpful for login - you need the password.

With brute force, you can try to generate such a password, and for common names like 123456, password, asdf, secret, 1111 and so on, the shadow-values are already well known, and stored in so called rainbow-tables.

To prevent attacks with rainbow-tables, the password-function can use a salt, which influences the result, which means that every password uses a different salt, stored in the first two bytes of the password hash string (thanks to psusi, who corrected me), so that you would need a different rainbow-table for every password, which is not very practical - it takes too long to generate them, and is expensive.

I'm not sure, whether ubuntu uses a salt. We can wait for somebody who explains it to us, or you could generate the same user with the same password on two machines, and compare the value in /etc/shadow.

share|improve this answer
    
Yes, Ubuntu uses salted hashes, using SHA-512 as the hash function. –  Capt.Nemo Jun 22 '11 at 1:56
1  
The salt is not constant for all passwords on the machine; a new one is generated for each password every time one is stored in /etc/shadow. The salt is stored in the first two bytes of the password hash string. –  psusi Jun 22 '11 at 13:50
    
Thanks, I included your correction in my text. –  user unknown Jun 22 '11 at 14:06

The passwords (or better hashes) are most probably stored in the LDAP server. "Most probably" means that you could have a very strange setup where they are not. LDAP configuration is very flexible, but that also means that without inspecting the config files a clear answer on how it is done in your situation cannot be given. You probably have looked into /etc/ldap.conf on the client for details of the configuration?

One possible setup for LDAP authentication is like this: the client box takes username and password from the login, and performs a bind to the LDAP server with this information. The LDAP server verifies username & password and either returns success or failure. In this setup, the client box never sees the stored password hash from the LDAP server.

Do you know the type of LDAP server used? Whether you can see the hashed user passwords depends on the setup of the LDAP server. See as an example http://www.faqs.org/docs/securing/chap26sec213.html on what you could configure on an OpenLDAP server.

The answer on password hashing from "user-unknown" is correct, it is only that the hashes are not stored in /etc/shadow but in the LDAP server. The hashing itself might also be performed by the LDAP server and not the client box.

share|improve this answer
    
I only know it's LDAPv3, probably OpenLDAP. In /etc/ldap.conf only uri, base and ldap_version are set/uncomment. bindpw, binddn, rootbinddn etc. are all commented. –  redman Jun 22 '11 at 22:41
    
On your original question, what config files: /etc/nsswitch.conf (lines "passwd" and "shadow"), /etc/pam.d/*ldap* (lines with "pam_ldap.so"), /etc/pam.conf (probably not used), /etc/pam_ldap.conf (might not exist), /etc/ldap.conf. The default field for user passwords is "userPassword", but your setup might be different. Without the credentials of the directory administrator you might have difficulties to see this field, it is quite common practice to hide it from users. –  HelmuthB Jun 23 '11 at 10:26

Did you try
- phpldapadmin?
- ldapsearch -LLL -x -b "dc=your,dc=domain" uid=* (or replace * by username, maybe it's cn instead of uid)
If the passwords are stored within ldap, you should see them with this methods.

If the computer is a domain controller, maybe it has smbldap-tools installed, so you can just reset passwords with smbldap-passwd username

You might also want to check your pam.d config (/etc/pam.d/common-*) to find out what login mechanism your computer is using.

share|improve this answer
    
I don't see any hash or plain-text password in LDAP user's entry. –  redman Jun 22 '11 at 8:01
    
Is pam.d configured to authenticate against ldap? –  sBlatt Jun 22 '11 at 9:39
    
Yes it is... # here are the per-package modules (the "Primary" block) account [success=2 new_authtok_reqd=done default=ignore] pam_unix.so #new_line# account [success=1 default=ignore] pam_ldap.so # here's the fallback if no module succeeds account requisite pam_deny.so –  redman Jun 22 '11 at 22:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.