understanding sha512 hash in /etc/shadow

Question

for RHEL-8.10 with /etc/login.defs having ENCRYPT_METHOD SHA512 for my local ron account I set {as root} the password for it to also be just ron.

As such in /etc/shadow I have this:

ron:$6$NbmOz0kL4eKjJbwi$JE1.19BxJWh7cbZjmPPDrviuBV7l7h/Jlqz56CVqXmpttsXbz3YjhQ9Qm0CiYAY8oG4jkatTqXVgiAfbU66rR1:20377:0:99999:14:::

In trying to use the https://randommer.io/Hash/SHA512 webpage I have typed in ron for the password text and use this for the salt: NbmOz0kL4eKjJbwi and it gives me this

FD1C072B6D4578F30D5615F189D9317D8E24CAC2D60C0A6D280636C9035ED12A8C64F2C9F4D542C6BC4750373C6BA88745D2159428F04BB5FE068285F4B41D08

what am I doing wrong, and what is an easy/correct way whether it be in linux on the command line or using a free online tool to replicate the hash stored in /etc/shadow for when I have set the password to be just ron ?

Answer 1

The first visible difference is that the /etc/shadow file represents the hash result in Base64 while the website returns it in hexadecimal (base-16). The same bytes can be written in several different ways.

But the main difference is that the password hash in /etc/shadow is not produced by a single application of plain SHA512 – it's a sha512crypt hash.

The sha512crypt algorithm applies many iterations of SHA512 in a specific way, in an attempt to make hash calculation slower and resist brute force attacks. It's similar in principle to PBKDF2-SHA512.

(Plain SHA512 also doesn't define an exact method of including the salt – Base64-decode or not? prepended before the input? appended after? integrated in a different way? – the website you found just does whatever.)

The correct way to generate such hashes is to call crypt(3), but note that the $6$ prefix needs to be included as part of the salt string. On Linux the crypt() function can also generate Bcrypt $2b$ hashes and Yescrypt $y$ hashes, both of which are stronger than sha512crypt (see crypt(5) for an overview).

On older Linuxes, crypt() and libcrypt used to be part of libc.

The same crypt() also exists on other Unix-ish systems, e.g. OpenBSD, but with slightly varying interfaces and algorithms, e.g. some platforms might not have sha512crypt at all.

There's no built-in CLI tool for generating a hash for /etc/shadow, except by manually setting the password using passwd and then copying the resulting hash out of your /etc/shadow. But various tools named 'mkpasswd' do exist (though many are limited in which algorithms they support).

Python's passlib can also generate such hashes.

Answer 2

The standard library routine in C would be crypt(3). The second argument is the whole $6$NbmOz0kL4eKjJbwi string because that identifies the algorithm and the seed.

eg

// Compile with -lcrypt

#include <crypt.h>
#include <stdio.h>

void main()
{
  printf("%s\n",crypt("ron","$6$NbmOz0kL4eKjJbwi"));
}

So let's test this:

% gcc -o cr cr.c -lcrypt
% ./cr
$6$NbmOz0kL4eKjJbwi$JE1.19BxJWh7cbZjmPPDrviuBV7l7h/Jlqz56CVqXmpttsXbz3YjhQ9Qm0CiYAY8oG4jkatTqXVgiAfbU66rR1

This is also exposed to other languages; e.g. perl. So, for example, we can test this from the perl debugger

% perl -d -e 0
...
  DB<1> print crypt('ron','$6$NbmOz0kL4eKjJbwi')
$6$NbmOz0kL4eKjJbwi$JE1.19BxJWh7cbZjmPPDrviuBV7l7h/Jlqz56CVqXmpttsXbz3YjhQ9Qm0CiYAY8oG4jkatTqXVgiAfbU66rR1

Answer 3

You could use openssl's passwd subcommand:

$ printf %s ron | openssl passwd -6 -salt NbmOz0kL4eKjJbwi -stdin
$6$NbmOz0kL4eKjJbwi$JE1.19BxJWh7cbZjmPPDrviuBV7l7h/Jlqz56CVqXmpttsXbz3YjhQ9Qm0CiYAY8oG4jkatTqXVgiAfbU66rR1

You can change the number of rounds from its default (of 5000) with:

$ printf %s ron | openssl passwd -6 -salt 'rounds=99999$NbmOz0kL4eKjJbwi' -stdin
$6$rounds=99999$NbmOz0kL4eKjJbwi$.ePLjWxD4ZZBucJ7b7qxgu0KloBrOsflOkBz.054pdzhXm4TmBDZkpnZMVHf1yaHuGNBODZStLAQ0Z4O..zb9/

Same as:

$ printf %s ron | perl -lspe '$_=crypt$_,$salt' -- -salt='$6$rounds=99999$NbmOz0kL4eKjJbwi'
$6$rounds=99999$NbmOz0kL4eKjJbwi$.ePLjWxD4ZZBucJ7b7qxgu0KloBrOsflOkBz.054pdzhXm4TmBDZkpnZMVHf1yaHuGNBODZStLAQ0Z4O..zb9/

But without using the system's libc's crypt().