Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The previous SF questions I've seen have lead to answers that produce MD5 hashed password.

Does anyone have a suggestion on to produce an SHA-512 hashed password? I'd prefer a one liner instead of a script but, if a script is the only solution, that's fine as well.

Update

Based on davey's answer, I've created a one-liner that's a bit longer than davey's but some others may find useful:

python -c "import crypt,random,string; print crypt.crypt(raw_input('clear-text password: '), '\$6\$' + ''.join([random.choice(string.ascii_letters + string.digits) for _ in range(16)]))"

There's also this more elegant one but requires the passlib module which isn't installed by default:

python -c "from passlib.hash import sha512_crypt; print sha512_crypt.encrypt(raw_input('clear-text password: '))"
share|improve this question
2  
SHA and MD5 are not encryption. They're hashing algorithms. The crucial difference being that the hashed data is not recoverable. What do you need to do? –  SmallClanger Nov 11 '11 at 11:28
    
Thank you. Modified the question. man 5 shadow refers to it as "encrypted password" so I went along with that term. –  Belmin Fernandez Nov 11 '11 at 12:22
1  
Apologies if that was a bit snarky. Are you trying to manually generate shadow-compatible password hashes? If so, take a look at your /etc/shadow contents. You'll see $x$salt$hash. x denotes the algorithm used by crypt, with 6 being typical on modern linuxes, which is sha512 (see man 3 crypt). Either of the below answers will produce the same hash, so long as you give it the same salt. –  SmallClanger Nov 11 '11 at 13:20
1  
Oh no, not snarky at all. You clarified something I was confused about so I am very thankful sir! –  Belmin Fernandez Nov 11 '11 at 15:26

13 Answers 13

up vote 31 down vote accepted

Here's a one liner:

python -c 'import crypt; print crypt.crypt("test", "$6$random_salt")'

6 is the type of hash for SHA-512

  • 1 -> MD5
  • 2a -> Blowfish (not in mainline glibc; added in some Linux distributions)
  • 5 -> SHA-256 (since glibc 2.7)
  • 6 -> SHA-512 (since glibc 2.7)

I'd recommend you look up what salts are and such and as per smallclamgers comment the difference between encryption and hashing.

Update: The string produced is suitable for shadow and kickstart scripts.

share|improve this answer
    
Thank you very much!! –  Belmin Fernandez Nov 11 '11 at 20:30
1  
Importing the getpass and pwd modules is not necessary. –  akaihola Feb 16 '12 at 13:17
    
Why does it need the random_salt (or SALTsalt) bits? –  Wilf Jun 6 at 15:58
    
Replace random_salt with an actual random salt. –  Belmin Fernandez Jul 31 at 13:44

On Debian you can use mkpasswd to create passwords with different hashing algorithms suitable for /etc/shadow. It is included in the package whois (according to apt-file)

mkpasswd -m sha-512
mkpasswd -m md5

to get a list of available hashing algoritms type:

mkpasswd -m help 

HTH

share|improve this answer
3  
What package provides it? There's a mkpasswd program (part of expect) under Fedora too, but it's useless for this purpose. –  Cristian Ciupitu Mar 2 '13 at 2:31
    
As he said, the version of mkpasswd he's talking about is for Debian/Ubuntu. The mkpasswd on Fedora (at least up to 14) is missing the -m switch. –  slm May 19 '13 at 3:47
    
Curiously, it's the whois package, legacy from Debian. See dpkg -S /usr/bin/mkpasswd I couldn't believe it myself :D –  Robert Ševčík - Robajz Jun 18 at 21:23

Best Answer: grub-crypt

Usage: grub-crypt [OPTION]...
Encrypt a password.

-h, --helpPrint this message and exit
-v, --version           Print the version information and exit
--md5                   Use MD5 to encrypt the password
--sha-256               Use SHA-256 to encrypt the password
**--sha-512             Use SHA-512 to encrypt the password (default)**
share|improve this answer
1  
Simple solution..worked for me on CentOS 6. –  Banjer May 1 '13 at 12:15

Here is a one-liner that uses shell commands to create a SHA-512 hashed password with a random salt:

[root@host] mkpasswd -m sha-512 MyPAsSwOrD $(openssl rand -base64 16 | tr -d '+=' | head -c 16)

Notes

  1. You may need to install the "whois" package (Debian, SuSE, etc.), which provides "mkpasswd".
  2. See crypt(3) for details on the format of lines in "/etc/shadow".
share|improve this answer
    
Unfortunately the whois package from Fedora 18 doesn't provide any mkpasswd. –  Cristian Ciupitu Mar 2 '13 at 2:38
    
In Arch Linux: /usr/bin/mkpasswd is owned by expect 5.45-3 –  Nowaker Nov 9 '13 at 21:18
    
Same on Fedora 20 and it does something else. –  Cristian Ciupitu Apr 17 at 19:23
1  
Unfortunately the suggested command has two problems: 1) The supplied password is now stored in your shell's history, and is visible to anyone with the 'history' command or similar. 2) You don't need to supply the random salt on the command line - and I think you should let mkpasswd do it for you instead of using funky openssl tricks. (Note that this is true at least on Ubuntu Quantal. You can test it by running 'mkpasswd -m sha-512 foo' multiple times. You will see the salt changes. The salt is the value between the 2nd and 3rd $ characters.) –  oskarpearson Jun 3 at 8:40

Why not perform the following check and modification to Centos/RHEL machines to ensure that all password hashing for /etc/shadow is done with sha512. Then you can just set your passworkd normally with the passwd command

#Set stronger password hasing
/usr/sbin/authconfig --test | grep sha512 > /dev/null
if [ $? -ne 0 ]; then
echo "Configuring sha512 password hashing"
sudo /usr/sbin/authconfig --enableshadow --passalgo=sha512 --updateall
fi
share|improve this answer

Here's a short C code to generate the SHA-512 password on CentOS (RHEL as well, of course!).

File: passwd-sha512.c

#define XOPEN_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

int main(int argc, char *argv[]) {
  if ( argc < 2 || (int) strlen(argv[2]) > 16 ) {
    printf("usage: %s password salt\n", argv[0]);
    printf("--salt must not larger than 16 characters\n");
    return;
  }

  char salt[21];
  sprintf(salt, "$6$%s$", argv[2]);

  printf("%s\n", crypt((char*) argv[1], (char*) salt));
  return;
}

to compile:

/usr/bin/gcc -lcrypt -o passwd-sha512 passwd-sha512.c

usage:

passwd-sha512 <password> <salt (16 chars max)>
share|improve this answer
    
This question is 3 years old... –  Grumpy Feb 13 at 10:47

HASH algos are for producing MESSAGE digests, they are never suitable for passwords, which should use some kind of HKDF ( http://tools.ietf.org/rfc/rfc5869.txt ) - see PBKDF2 or BCrypt

share|improve this answer
#!/usr/bin/env python

import getpass

from passlib.hash import sha512_crypt

if __name__ == "__main__":
    passwd = getpass.getpass('Password to hash: ')
    hash = sha512_crypt.encrypt(passwd)

    print hash

You can clone it from my github repo if you want: https://github.com/antoncohen/mksha

share|improve this answer

Its not a one liner, but it might help someone:

import crypt, getpass, pwd, string, sys, random
randomsalt = ""
password = getpass.getpass()
choices = string.ascii_uppercase + string.digits + string.ascii_lowercase
for _ in range(0,8):
    randomsalt += random.choice(choices)
print crypt.crypt(password, '$6$%s$' % randomsalt)
share|improve this answer

For those of the Ruby mindset here is a one-liner:

'password'.crypt('$6$' + rand(36 ** 8).to_s(36))
share|improve this answer

Perl one-liner solution to generate SHA-512 hashed password:

perl -e 'print crypt("desiredPassword","\$6\$customSalt\$") . "\n"'

Worked on RHEL 6

share|improve this answer
$ htpasswd -c /tmp/my_hash user1
New password: 
Re-type new password: 
Adding password for user user1
$ cat /tmp/my_hash
user1:$apr1$oj1ypcQz$4.6lFVtKz2nr8acsQ8hD30

Obviously, you just grab the 2nd field, and can delete the file once you're added it to shadow or for use with sudo (still most likely shadow).

share|improve this answer

I'm not sure how SHA-512 is related to /etc/shadow. These passwords are crypted.

But if you want a password hashed with SHA-512 you can do this by echo -n the_password | sha512sum. You can't use the output for /etc/shadow.

share|improve this answer
1  
echo -n the_password so you're not hashing the newline. </pedant> –  SmallClanger Nov 11 '11 at 13:14
    
Passwords in shadow aren't crypt()ed any more since years. Modern systems use at least md5. –  Alexander Janssen Oct 3 '12 at 20:40
3  
Actually passwords in shadow are still crypt()ed but the function has been updated to support several different algorithms. Regardless, the method described in this answer does not produce suitable hash for /etc/shadow. The algorithm is more complex than a single SHA-512 hash round. –  snap Jan 5 '13 at 0:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.