Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In order to make passwords more secure , a random salt is added to the password before harshing occurs .

I am assuming the salt is stored on the server in an associative array [username:salt] and the server appends the salt to the password before harshing everytime the user logins else the server wouldnt know what random salt to append to the password

1) Is my assumption correct ???

2) Is the salt normally stored in plain text or cipher on the server and why ??

3) Which file is it stored in ?? ( i know this may be subjective as it depends on the different servers)

I would like a detailed explaination if possible

Thanks

share|improve this question
add comment

1 Answer

It's concatenated with the encrypted password string (possibly with delimiter characters, possibly just a fixed number of characters; depends on which particular password file you're talking about) So, for example, my /etc/shadow contains $6$prRzIBxG$K4w0950HW9eMmVgzqpmdgfpxqmFtXZx.mS7wGorSoeXvt51tejXxx22CoTsrmj9AsszgT.CvkB5BrPuMq1r.Z/ as the encrypted password. The $6$ is a control sequence, and the salt is pr.

(Note, that's on password-file systems like UNIX; you also tagged IIS, but Windows stores passwords, salts, etc. in a rather opaque datastructure called a SAM.)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.