Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've been trying to configure my server for security, but I have no idea what I'm doing. I'm following various guides to the best of my ability - one of them being the following: http://wiki.centos.org/HowTos/OS_Protection

After making changes and logging out, my passwords no longer work when attempting to log back in. These are the two changes that I suspect may be causing the issue:

1) I changed the password protection from md5 to sha512 with the following code:

authconfig --passalgo=sha512 --update


2) I changed /etc/pam.d/system-auth to look like this:

touch /var/log/tallylog
cat << 'EOF' > /etc/pam.d/system-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        required      pam_deny.so
auth        required      pam_tally2.so deny=3 onerr=fail unlock_time=60

account     required      pam_unix.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     required      pam_permit.so
account     required      pam_tally2.so per_user

password    requisite     pam_cracklib.so try_first_pass retry=3 minlen=9 lcredit=-2 ucredit=-2     dcredit=-2 ocredit=-2
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=10
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
EOF

How can I fix this? Am I going to need to reinstall CentOS and start from scratch?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

You'll need to reboot into single user mode.

Follow the instructions at:- http://www.centos.org/docs/5/html/Installation_Guide-en-US/s1-rescuemode-booting-single.html

That should put you on as root. Then you simply passwd all the user passwords you need.

share|improve this answer
    
I'm accessing the system remotely via SSH (I purchased the server space from a hosting company), so I don't get the chance to see the GRUB screen as instructed in your link. Also, one of the changes made because of the article I linked in the OP mandates a password for single-user mode. The code used is as follows: echo "~~:S:wait:/sbin/sulogin" >> /etc/inittab. –  Nick Apr 4 '11 at 8:32
1  
Okay, well chat to the hosting compnay to see if they can reset the password for you otherwise it looks like it's going to be a reinstall. –  Decado Apr 4 '11 at 9:42

The passwords that already exist in /etc/shadow will have been created using MD5. You will need to recreate them now that you have changed the hashing scheme.

share|improve this answer
    
How do I do this if I can't log in? I should clarify - I can't log in with root either. –  Nick Apr 4 '11 at 8:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.