Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to change my SHA512 shadow file to use bcrypt as shown in this question/answer: Enable blowfish-based hash support for crypt

The problem is that i run into a chicken and egg problem, because the existing shadow-file is SHA512 encrypted, which means sudo doesn't work anymore as soon as i edit

share|improve this question
up vote 4 down vote accepted

You hashed password entries also have formatting information in them.

"$id$salt$encrypted", where "$id" is the hashing algorithm used (On GNU/Linux, "$1$" stands for MD5, "$2$" is Blowfish, "$5$" is SHA-256 and "$6$" is SHA-512, crypt(3) manpage, other Unix may have different values, like NetBSD).

If your users' passwords have a time-based expiry, they'll eventually have to update them and the new hash will be in the format you've chosen. The system can tell which format passwords hashes are in per user, so things will keep working as passwords are updated over time.

As it also says in the answer you reference:

Passwords that are updated after these modifications are made will be hased using blowfish, exising shadow passwords are not modified

share|improve this answer
But if i change the mechanism in the pam.d files, does it still "know how to do md5"? – Fabian Zeindl Apr 11 '12 at 10:51
@FabianZeindl Yes, it should. The PAM mechanism will define setting the password, but the algorithm used to check it is defined by the hash string. The PAM mechanism that handles verification should know all methods it might encounter. – Jeff Ferland Apr 11 '12 at 13:50

The nature of one-way password hashing makes it impossible (or nearly impossible) to reverse the hashes back into plaintext for the purpose of re-hashing them into blowfish or any other one-way hashing algorithm. However, it's my understanding that your existing md5/sha512/etc passwords will still work.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.