Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Our server is currently using the blowfish cipher to store passwords and it uses pam_unix2. We'd like to gradually switch to SHA. The idea is that all newly changed passwords would be hashed with SHA. But I don't know how to configure PAM for that, namely common-password. If I use pam_unix2, it cannot save new passwords with SHA. If I use pam_unix, it cannot verify old, blowfish passwords. Is there a way how to verify the old passwords with one module and set new with another?

share|improve this question

It depends on whether the password interface checks the current password, or whether this is done by the normal auth interface. I would suspect the latter due to root being able to set other users' passwords without providing the user's previous password, in which case you should be able to do something like this:

# Accept authentication with either Blowfish or SHA512
auth        sufficient
auth        sufficient

# Set new passwords only with SHA512
password    required sha512
share|improve this answer
I tried it, but it doesn't work. I dug into pam_unix's source and it checks for the old password by itself. Checking for root is also done there. So any previous additional modules probably don't have any effect on it. I'm afraid that what I want is currently impossible. – Petr Pudlák Feb 9 '13 at 9:32
@PetrPudlák Darn :-( – mgorven Feb 9 '13 at 19:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.