10

I am setting up a new account on a Linux box for Subversion repository access, and can send the password to the new user. However, I think there was a command line utility for this new user to encrypt the password he likes into a format I can copy/paste directly into the /etc/shadow file.

What was the full command that this new user should run on the console (e.g. Bash) to create such an encrypted password?

UPDATE: the user will not be allowed to log in on the machine, and the account will merely be used for svn+ssh:// access. Therefore, the user cannot change it himself.

Improve this question
1
  • User is asking about bash scripting, since he's obviously not going to do this manually.
    – Tim Post
    Nov 24, 2009 at 17:10

6 Answers 6

Reset to default
16

the user can execute on his computer something like:

echo "password"|openssl passwd -1 -stdin

and then send you the output.

Improve this answer
4
  • +1 does exactly what you are looking for.
    – Antoine Benkemoun
    Nov 24, 2009 at 20:54
  • Why is that command giving a different value each time I call it?
    – Egon Willighagen
    Nov 24, 2009 at 21:17
  • 2
    The format of the output is $id$salt$encrypted. Different id and different salt give you a different encrypted string. The id is the algorithm used: 0-DES, 1->MD5, 2a->Blowfish, 5->SHA-256, 6->SHA512
    – Gonzalo
    Nov 24, 2009 at 22:05
  • OK, so I need to figure out how to trigger a certain id (which was the same all the time) and salt (which changed with each call)... makes sense.
    – Egon Willighagen
    Nov 25, 2009 at 7:44
2

The format of the password in shadow can vary. You could set it to be MD5 or the good old DES3 or... You are good sending your user a password and forcing her to change it in the first login (# chage -d 0 username)

Improve this answer
1

Instead of having them encrypt the password and send it to you, why not just tell them to type:

passwd

It will do everything you want with the added advantage that they can change their passwords without any extra work for you.

EDIT: According to this, there's supposedly a command called makepassword that you can get for Debian/Ubuntu.

Improve this answer
5
  • Because that requires the user to already be logged in. The OP wants a solution to set the password securely before the user logs in for the first time.
    – Daniel Pryden
    Nov 24, 2009 at 16:58
  • 1
    It seems like randomly generating a password and having them change it when they log in is just as secure as having them generate a password and manually adding it.
    – Brendan Long
    Nov 24, 2009 at 17:28
  • The user will actually never login (shell:/bin/false), and only allow SVN read/write access...
    – Egon Willighagen
    Nov 24, 2009 at 18:16
  • 2
    You could set shell:/usr/bin/passwd :D
    – Brendan Long
    Nov 24, 2009 at 18:28
  • 1
    I mean that last comment as joke, but apparently it will work: markmail.org/message/ekuxvnhdagywy4i5
    – Brendan Long
    Nov 24, 2009 at 18:30
0

/etc/passwd and /etc/shadow are very easy to tokenize with the usual command line tools (i.e. grep, awk, sed, tr, etc).

What becomes interesting is the actual password hash field in /etc/shadow, its prefix tells you how the password has been encrypted. From man (5) shadow :

The password field must be filled. The encrypted password consists of 13 to 24 characters from the 64 characters alphabet a thru z, A
thru Z, 0 thru 9, \. and /. Optionally it can start with a "$" character. This means the encrypted password was generated using another
(not DES) algorithm. For example if it starts with "$1$" it means the MD5-based algorithm was used.

How it was encrypted broadly depends on how old the installed OS happens to be. Its important to pay special attention to the second field in /etc/shadow.

You should make every effort to follow whatever hash the system is using, be it DES, MD5, etc, since its so easy to detect.

Improve this answer
0

Why not SU into to the user and run passwd?

Improve this answer
1
  • Because I do not want to know the password... or have it send to me in an unencrypted form.
    – Egon Willighagen
    Nov 24, 2009 at 18:17
0

Is there a way to generate this passwords via command line? Yes, with debian package makepasswd (but only for MD5):

echo "mypasswd" | makepasswd --crypt-md5
$1$r2elYKyB$vUr/Ph.brKTldM2h2k8J5.

But this will not work via copy and paste inside /etc/shadow To change password via script in some linux distributions, you can use:

echo oracle:mypasswd | chpasswd

or

echo -n mypasswd | passwd --stdin oracle
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.