How to create an SHA-512 hashed password for shadow?

Question

The previous SF questions I've seen have lead to answers that produce MD5 hashed password.

Does anyone have a suggestion on to produce an SHA-512 hashed password? I'd prefer a one liner instead of a script but, if a script is the only solution, that's fine as well.

Answer 1

Here's a one liner:

python -c "import crypt, getpass, pwd; print crypt.crypt('password', '\$6\$SALTsalt\$')"

6 is the type of hash 6 = sha512

1 = MD5 2a = Blowfish (not in mainline glibc; added in some Linux distributions) 5 = SHA-256 (since glibc 2.7) 6 = SHA-512 (since glibc 2.7)

I'd recommend you look up what salts are and such and as per smallclamgers comment the difference between encryption and hashing.

Update: The string produced is suitable for shadow and kickstart scripts.

Answer 2

On Debian you can use mkpasswd to create passwords with different hashing algorithms suitable for /etc/shadow. It is included in the package whois (according to apt-file)

mkpasswd -m sha-512
mkpasswd -m md5

to get a list of available hashing algoritms type:

mkpasswd -m help 

HTH

Answer 3

Best Answer: grub-crypt

Usage: grub-crypt [OPTION]...
Encrypt a password.

-h, --helpPrint this message and exit
-v, --version           Print the version information and exit
--md5                   Use MD5 to encrypt the password
--sha-256               Use SHA-256 to encrypt the password
**--sha-512             Use SHA-512 to encrypt the password (default)**

Answer 4

Why not perform the following check and modification to Centos/RHEL machines to ensure that all password hashing for /etc/shadow is done with sha512. Then you can just set your passworkd normally with the passwd command

#Set stronger password hasing
/usr/sbin/authconfig --test | grep sha512 > /dev/null
if [ $? -ne 0 ]; then
echo "Configuring sha512 password hashing"
sudo /usr/sbin/authconfig --enableshadow --passalgo=sha512 --updateall
fi

Answer 5

HASH algos are for producing MESSAGE digests, they are never suitable for passwords, which should use some kind of HKDF ( http://tools.ietf.org/rfc/rfc5869.txt ) - see PBKDF2 or BCrypt

Answer 6

Here is a one-liner that uses shell commands to create a SHA-512 hashed password with a random salt:

[root@host] mkpasswd -m sha-512 MyPAsSwOrD $(openssl rand -base64 16 | tr -d '+=' | head -c 16)

Notes

1. You may need to install the "whois" package (Debian, SuSE, etc.), which provides "mkpasswd".
2. See crypt(3) for details on the format of lines in "/etc/shadow".

Answer 7

#!/usr/bin/env python

import getpass

from passlib.hash import sha512_crypt

if __name__ == "__main__":
    passwd = getpass.getpass('Password to hash: ')
    hash = sha512_crypt.encrypt(passwd)

    print hash

You can clone it from my github repo if you want: https://github.com/antoncohen/mksha

Answer 8

Its not a one liner, but it might help someone:

import crypt, getpass, pwd, string, sys, random
randomsalt = ""
password = getpass.getpass()
choices = string.ascii_uppercase + string.digits + string.ascii_lowercase
for _ in range(0,8):
    randomsalt += random.choice(choices)
print crypt.crypt(password, '$6$%s$' % randomsalt)

Answer 9

I'm not sure how SHA-512 is related to /etc/shadow. These passwords are crypted.

But if you want a password hashed with SHA-512 you can do this by echo -n the_password | sha512sum. You can't use the output for /etc/shadow.