How do you figure out where are user's passwords stored, for users that can login? I know the system is using LDAP for users (username, home path, etc.), but it doesn't contain any kind of passwords. I have access to a configured machine, so how do I figure out where are passwords? (which config file?)
Passwords aren't stored themselve. They are transformed by a function, and the so produced value, which is called
If you login, the same function is performed on your input, and the generated value compared with the one in the stored value in the
The function is of a kind, which is hard to invert. So with the value in /etc/shadow, you can not calculate the original password, and the key in there is not helpful for login - you need the password.
With brute force, you can try to generate such a password, and for common names like
To prevent attacks with rainbow-tables, the password-function can use a
I'm not sure, whether ubuntu uses a salt. We can wait for somebody who explains it to us, or you could generate the same user with the same password on two machines, and compare the value in /etc/shadow.
The passwords (or better hashes) are most probably stored in the LDAP server. "Most probably" means that you could have a very strange setup where they are not. LDAP configuration is very flexible, but that also means that without inspecting the config files a clear answer on how it is done in your situation cannot be given. You probably have looked into
One possible setup for LDAP authentication is like this: the client box takes username and password from the login, and performs a bind to the LDAP server with this information. The LDAP server verifies username & password and either returns success or failure. In this setup, the client box never sees the stored password hash from the LDAP server.
Do you know the type of LDAP server used? Whether you can see the hashed user passwords depends on the setup of the LDAP server. See as an example http://www.faqs.org/docs/securing/chap26sec213.html on what you could configure on an OpenLDAP server.
The answer on password hashing from "user-unknown" is correct, it is only that the hashes are not stored in
Did you try