up vote 2 down vote favorite
1
share [g+] share [fb]

The previous SF questions I've seen have lead to answers that produce MD5 hashed password.

Does anyone have a suggestion on to produce an SHA-512 hashed password? I'd prefer a one liner instead of a script but, if a script is the only solution, that's fine as well.

link|improve this question
90% accept rate
SHA and MD5 are not encryption. They're hashing algorithms. The crucial difference being that the hashed data is not recoverable. What do you need to do? – SmallClanger Nov 11 '11 at 11:28
Thank you. Modified the question. man 5 shadow refers to it as "encrypted password" so I went along with that term. – Beaming Mel-Bin Nov 11 '11 at 12:22
Apologies if that was a bit snarky. Are you trying to manually generate shadow-compatible password hashes? If so, take a look at your /etc/shadow contents. You'll see $x$salt$hash. x denotes the algorithm used by crypt, with 6 being typical on modern linuxes, which is sha512 (see man 3 crypt). Either of the below answers will produce the same hash, so long as you give it the same salt. – SmallClanger Nov 11 '11 at 13:20
Oh no, not snarky at all. You clarified something I was confused about so I am very thankful sir! – Beaming Mel-Bin Nov 11 '11 at 15:26
feedback

3 Answers

up vote 4 down vote accepted

Here's a one liner:

python -c "import crypt, getpass, pwd; print crypt.crypt('password', '\$6\$SALTsalt\$')"

6 is the type of hash 6 = sha512

1 = MD5 2a = Blowfish (not in mainline glibc; added in some Linux distributions) 5 = SHA-256 (since glibc 2.7) 6 = SHA-512 (since glibc 2.7)

I'd recommend you look up what salts are and such and as per smallclamgers comment the difference between encryption and hashing.

Update: The string produced is suitable for shadow and kickstart scripts.

link|improve this answer
Thank you very much!! – Beaming Mel-Bin Nov 11 '11 at 20:30
Importing the getpass and pwd modules is not necessary. – akaihola Feb 16 at 13:17
feedback
up vote 1 down vote

I'm not sure how SHA-512 is related to /etc/shadow. These passwords are crypted.

But if you want a password hashed with SHA-512 you can do this by echo -n the_password | sha512sum. You can't use the output for /etc/shadow.

link|improve this answer
echo -n the_password so you're not hashing the newline. </pedant> – SmallClanger Nov 11 '11 at 13:14
feedback
up vote 0 down vote

Why not perform the following check and modification to Centos/RHEL machines to ensure that all password hashing for /etc/shadow is done with sha512. Then you can just set your passworkd normally with the passwd command 

#Set stronger password hasing
/usr/sbin/authconfig --test | grep sha512 > /dev/null
if [ $? -ne 0 ]; then
echo "Configuring sha512 password hashing"
sudo /usr/sbin/authconfig --enableshadow --passalgo=sha512 --updateall
fi
link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.