Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I recently upgraded an ubuntu server with many users to a recent version from a version from 2008. The server used to use md5 password hashes (e.g., the shadow passwords began with $1$) and now is configured to use sha512.

I'd prefer to keep using sha512, but would like the old users to be able to partially login once with their old password and then be forced to update their password (even if its the same password) generating a sha512. Right now, the old md5-based passwords in /etc/shadow won't let the user login at all (and just appear to be incorrect passwords).

This seems like plenty of people should have had to do this before; yet I can't see how to do it, looking in the common places like /etc/pam.d/common-password nad /etc/login.defs. Also users will be logging in via ssh; and I do not have everyone's contact info (email or otherwise); and some login fairly rarely.

Any help? (Googling doesn't seem to give any good solutions).

share|improve this question
up vote 1 down vote accepted

Theoretically it should work like this: Users should be able to login with their MD5 passwords, and whenever they change it they would get an SHA512 password.

Difficult to judge why people cannot login with their MD5 password. Authentication with the SHA512 passwords works? If you temporary change to MD5 and change a password of a test user, can you then login for him? Maybe you can post the /etc/pam.d/common-auth non-comment-lines for having a look. And of course logfiles could have some background-information.

For your wish of requiring people to change their password, you could set the last-change date to 0 in /etc/shadow. E.g. for the user foobar

sudo chage -d 0 foobar
share|improve this answer
Thanks. You were right about how it should have worked. (The problem seems to be that tcsh wasn't installed and was set as the default shell). – dr jimbob Jun 22 '11 at 15:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.