Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was expecting slappasswd to produce a fixed hash but it appears that the output is randomized as I never get the same output for the same input password:

$ slappasswd -s secret
{SSHA}mCXsPZkfgQYZr2mKHpy5Iav+2S2XlVU3
$ slappasswd -s secret
{SSHA}62oXsalJBuopYfHhi6hGp6AESuWNIVnd
$ slappasswd -s secret
{SSHA}0Ulc8+ugMi3NbTtWnclOFW1LKCqRdsT8

During authentication, how does slapd knows how to randomize the hash for the provided password in the same way so that it can match the password defined in the first place?

share|improve this question
add comment

1 Answer

Going out on a limb here, but I assume slappasswd is using a salted hash instead of a plain hash. This means that it adds a random prefix to your password, and saves that random prefix as part of the string you see in the slappasswd output. When you type your password, it adds the prefix to it, hashes the result and compares that to the string in the slappasswd output. If it matches, you are in. If it does not, you password was wrong :)

share|improve this answer
2  
Indeed. In particular, the default hash method for slappasswd is {SSHA}, or the salted version of SHA-1. –  justarobert Apr 15 '11 at 9:42
    
I agree, but my question remains: if the salt ends up as part of the hash that means you can't extract the salt from the hashed password. Accordingly how does slapd knows what salt to add when doing the password verification? (it has to add the same salt for the hashed passwords to be the same). –  user64204 Apr 15 '11 at 10:23
2  
@user: The part after {SSHA} contains both the salt and the hash. –  grawity Apr 15 '11 at 14:58
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.