Acceptable Hashes by shadow

Question

What hash algorithms does /etc/shadow accept?

I've tried generating password hashes from PHP, using password_hash("password1234", PASSWORD_DEFAULT);, but that doesn't seem to work when I try to authenticate once I replace a user's password to the hash provided by the hashes I generate with PHP.

Any reason why blowfish doesn't work? (I think PHP uses blowfish by default)

Answer 1

Passwords are hashed using the library functioncrypt(3); see the manual page for crypt(3). The function chooses the encryption function based on the format of the salt:

• $1$salt_chars$: use MD5
• $2a$salt_chars$: use Blowfish (not standard, most likely not available)
• $5$salt_chars$: use SHA-256
• $6$salt_chars$: use SHA-512
• Not in the form $type$salt_chars$: use DES as in the old days.

I have no idea if you can use PHP to emulate exactly what crypt(3) does.

Answer 2

I've tried generating password hashes from PHP, using password_hash("password1234", PASSWORD_DEFAULT)...

Then you need to save the output in the format that /etc/shadow expects, which, as explained by AlexP, is:

$<method>$<salt>$<hash>

password_hash's output is different. It returns:

$<method>$<cost>$<hash>

For example, a password of a (password_hash("a", PASSWORD_DEFAULT)) outputs, for me:

$2y$10$w4hgkTWvE37igKd9TMn8xOcCNT/L/lojOEkqaPyIW4qdyAp92GmHC

And the salt is weirdly part of the hash:

password_hash("a", PASSWORD_DEFAULT, ['salt'=>'abcdefghijklmnopqrstuv'])
// $2y$10$abcdefghijklmnopqrstuuj/LkVFwQAC6H0GkC0f1Bcmj82rKvDn.

But the shadow version is:

$6$OaeCC6PI$qGI4OTUD/seGOvJE.ckkrWMoqiVQBf8EXtQFto7MsKP8TyTCxPXPF66csX3c4ljdRnjM1U8W65EpwUgMF.4qf0

See the salt in the second field?

Anyway, I don't know what PHP is doing here. You should probably use crypt, but I'm no PHP expert and that's a question for SO.

Also, for me, man crypt reports that 2y is not understood by it:

If salt is a character string starting with the characters "$id$"  fol-
lowed by a string terminated by "$":

      $id$salt$encrypted

then  instead  of  using  the DES machine, id identifies the encryption
method used and this then determines  how  the  rest  of  the  password
string is interpreted.  The following values of id are supported:

      ID  | Method
      ---------------------------------------------------------
      1   | MD5
      2a  | Blowfish (not in mainline glibc; added in some
          | Linux distributions)
      5   | SHA-256 (since glibc 2.7)
      6   | SHA-512 (since glibc 2.7)