to cool things off a bit :)
Comments Off
1. /etc/shadow
On linux system user information are stored in /etc/passwd. This file is world-readable (readable by any user of the computer system, even nobody) So it is not a good idea to keep user passwords in it, even encrypted password.
The need to store (encrypted) password introduces the shadow file, which is /etc/shadow. It contains the password which has been encrypted with the salt, which is also in the shadow file.
contain of shadow file could be as follow:
luana:$1$TaORQ38u$Mfaih1b244CcesjU7Sj2T1:13975:0:99999:7:::
here, luana is the username
$1$ indicates we’re using a salt (TaORQ38u) and md5sum is being used to encrypt the key, $ signifies the beginning of the encrypted password (Mfaih1b244CcesjU7Sj2T1) and ends before :
2. Salt
salt is a string, publicly available (if you can see encrypted passwords you can see the salt), used to help with the password encryption process. Since encryption is a on-to function (or a surjection - see http://mathworld.wolfram.com/Surjection.html) two of the same words will encrypt to the same ciphertext. This means on a system with very large amount of user there will be a chance someone will use some very bad passwords (like “password” etc) and it will shows as two identical ciphertext in the shadow file.
Salt is mostly unique to each user. It is often the encryption of the time the user is added to the system (thus relatively unique for each user). This salt is mixed with the user password before we start the encryption. This means for any given two users it is extremely unlikely that they are BOTH added to the system at the same time and use the same password.
Simply put, salts allow the system to afford users to use the same passwords without having two identical encrypted passwords in its password file.
3. Note about writing programs on linux that uses crypt()
crypt is standard to most c/c++ compilers on linux system. This means you don’t even have to do #include <> in your program to use these functions.
Example program:
#include <iostream>
int main()
{
std::cout<<crypt(”kccL;pw_d:”,”$1$TMVRB39B”);
return 0;
}
When compiled on linux system (with GNU cryptography library installed) you would run:
[lubox@neo 3]$ g++ hw3.cpp -o o -lcrypt
Notice the -lcrypt option at the end. This will tell the compiler that you are using crypt function.
The above program when run will yield output:
$1$TMVRB39B$PUaDAsZctLWtj0kteqvBe1
with the salt the same, and the password is encrypted into the preceding bold part.
4. …
