1

I had thought that the passwd command used the mcrypt command to encrypt its input, but instead is it crypt and/or encrypt? The source code of crypt/encrypt is not available.

When am not confusing this - then in earlier times of Linux, was passwd was using the command mcrypt? - Who can enlighten me?

I am asking this because I want to pimp up my password possibilities.

To elaborate on this question:
The command passwd asks for your password to be input, then in the background your password will be encrypted, after you finish providing it as input. This encrypted password is stored in the shadow file. I was thinking in earlier days this encryption was performed by mcrypt? Now my question is, what other commands and/or files does the command passwd involve in addition to those of shadow?

2
  • 2
    Please edit the question, it is difficult to tell what you are asking.
    – edwin
    Aug 11 '13 at 22:58
  • 1
    @edwin - question is done by Rinzwind. Please remove the "on hold"-feature. Aug 16 '13 at 23:35
3

crypt is a Unix utility. From the link:

Linux distributions generally do not include a Unix compatible version of the crypt command. This is largely due to a combination of three major factors:

  • crypt is relatively obscure and rarely used for e-mail attachments nor as a file format
  • crypt is considered far too cryptographically weak to withstand brute force attacks by modern computing systems (Linux systems generally ship with GNU Privacy Guard which is considered to be reasonably secure by modern standards)
  • During the early years of Linux development and adoption there was some concern that even as weak as the algorithm used by crypt was, that it might still run afoul of ITAR's export controls[citation needed]; so mainstream distribution developers in the United States generally excluded it[citation needed] (and left their customers to fetch GnuPG/GPG or other strong cryptographic software from international sites, sometimes providing packages or scripts to automate that process).

Source code for crypt can be found on the Unix Archive Sites.


mcrypt is the successor/Linux version of crypt and we have been using this (at least) since Lucid. Replacement for old unix crypt(1) it states at the package details.

Source code for mcrypt can be found here: mcrypt_2.6.8-1.3_i386.deb on Intel x86 machines

But this is not installed in a default Ubuntu.


But what you are looking for is probably registered in ...

/etc/login.defs

This is the place where Linux systems store what to use. By default, for Ubuntu, this is SHA512. So this is not an encryption but a hashed password starting with $6$.

Example using sha1sum:

$ echo hello|sha1sum
f572d396fae9206628714fb2ce00f72e94f2258f  -

--

Regarding comment see: http://packages.ubuntu.com/raring/makepasswd That is the one called to make the password from the plain text one.

Here is a source: http://people.defora.org/~khorben/projects/makepasswd/

Partial code:

switch(encryption)
    {
        case PE_BASE64:
            return _hash_base64(password);
        case PE_BLOWFISH:
            return _hash_blowfish(password, salt, iterations);
        case PE_DES:
            return _hash_des(password, salt);
        case PE_MD5:
            return _hash_md5(password);
        case PE_NONE:
            return _hash_none();
        case PE_SHA1:
            return _hash_sha1(password, salt, iterations);
        case PE_SHA256:
            return _hash_sha256(password, salt);
        case PE_SHA512:
            return _hash_sha512(password, salt);
        case PE_SHMD5:
            return _hash_shmd5(password, salt);
        default:
            errno = ENOSYS;
            _error("encryption", 1);
            return NULL;
    }

all the functions used are below this bit of code.

4
  • am still digging in source of passwd resp. shadow and of mcrypt - have not yet found in shadow, where encryption is launched for passwd - now have looked at /etc/login.defs but still not visible how it is launched by passwd. - need some more time... Aug 12 '13 at 10:29
  • aaaaaaaaaaah :) oh that should be simple. 1 sec @dschinn1001
    – Rinzwind
    Aug 12 '13 at 17:14
  • good now answer is complete ! have seen this code somewhere already in the source or in manpages, was then too quickly flying with my eyes ... big thx ! :) Aug 12 '13 at 21:20
  • question: it would have no effect, when I substitute in file of mcrypt ( in /mcrypt-2.6.8/src/getpass.c ) this: static char pass[512]; simply with this: static char pass[[[512,512,512,512],512,512,512,512],4]; ? Should I do this instead in files of makepasswd for new encryption-algorithm to pimp up my passwords ?! Aug 13 '13 at 11:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.