Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Our server is currently using the blowfish cipher to store passwords and it uses pam_unix2. We'd like to gradually switch to SHA. The idea is that all newly changed passwords would be hashed with SHA. But I don't know how to configure PAM for that, namely common-password. If I use pam_unix2, it cannot save new passwords with SHA. If I use pam_unix, it cannot verify old, blowfish passwords. Is there a way how to verify the old passwords with one module and set new with another?

share|improve this question

1 Answer 1

It depends on whether the password interface checks the current password, or whether this is done by the normal auth interface. I would suspect the latter due to root being able to set other users' passwords without providing the user's previous password, in which case you should be able to do something like this:

# Accept authentication with either Blowfish or SHA512
auth        sufficient      pam_unix2.so
auth        sufficient      pam_unix.so

# Set new passwords only with SHA512
password    required        pam_unix.so sha512
share|improve this answer
    
I tried it, but it doesn't work. I dug into pam_unix's source and it checks for the old password by itself. Checking for root is also done there. So any previous additional modules probably don't have any effect on it. I'm afraid that what I want is currently impossible. –  Petr Pudlák Feb 9 '13 at 9:32
    
@PetrPudlák Darn :-( –  mgorven Feb 9 '13 at 19:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.