Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I wanted to change my password on a unix machine. I did a normal "passwd" and typed in my old and my new password.

Then the machine came back to me with the following message:

BAD PASSWORD: is too similar to the old one

That got me thinking... Does that mean, the machine has my password in clear text somewhere? Otherwise it should not be able to compare the old and the new password, right? Or is there a hash function, that enables that?

share|improve this question
add comment

2 Answers

Your old passwords are not stored in plain text.

Instead, your old password hashes are stored in /etc/security/opasswd by PAM. It then makes the comparison when you go to change your password, based on what has been specified in the PAM configuration.

An example PAM config:

password required pam_unix.so sha512 remember=12 use_authtok

Here, remember causes it to remember 12 previous passwords.

For further detail, see Linux Password Security with pam_cracklib.

share|improve this answer
    
Mhm... well it definitely is not a password I ever used before... So it has to check for character changes to an old password. But if all that is saved is a hash of that password, how does it accomplish the comparison then? Isn't one the main functions of cryptographically secure hashes to not allow a comparison between to different clear texts? –  dertoni Sep 10 '12 at 6:06
    
You got me there. I think you'd have to read the source code to answer that one for sure. –  Michael Hampton Sep 10 '12 at 6:10
    
I would expect that it makes variations on the new password and if any of the hashes of these variations matches the hash of an old password, it's too similar. That way, only hashes are stored. Of course, I haven't checked this in the source code either... –  Ladadadada Sep 10 '12 at 6:23
    
ok, read the code... added an answer about my findings. +1 for helping me find the answer ;-) thx. –  dertoni Sep 10 '12 at 6:33
add comment
up vote 5 down vote accepted

OK, so I followed the suggestion of Michael Hampton and went and looked at the code of pam_cracklib.c and it seems as if pam_cracklib gets the old (aka current) password from the PAM via a function call (that I deem totally ok, as I just entered that current password to authenticate) and then performs a similarity analysis (distance function) between that old password and the new one I just entered.

But it does not do this analysis for all old passwords in its history. That would not be possible, cause they are only stored as hashes. For them there can only be a check if they are the same. So everything seems to be in order, just like I expected, but now I do understand why it is... thanks everyone.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.