to cool things off a bit :)
Comments Off
1. /etc/shadow
On linux system user information are stored in /etc/passwd. This file is world-readable (readable by any user of the computer system, even nobody) So it cs5.5 oem is not a good idea to keep user passwords in it, even encrypted password.
The need to store (encrypted) password introduces the shadow file, which is /etc/shadow. It contains the cs5.5 oem password which has been encrypted with the salt, which is also in the cs5.5 oem shadow file.
contain of shadow file could be as follow:
luana:$1$TaORQ38u$Mfaih1b244CcesjU7Sj2T1:13975:0:99999:7:::
here, luana is the username
$1$ indicates we’re using a salt (TaORQ38u) and md5sum is being used to encrypt the key, $ signifies the beginning of the encrypted password (Mfaih1b244CcesjU7Sj2T1) and ends before :
2. Salt
salt is a string, publicly available (if you can see encrypted passwords you can see the salt), used to cs5.5 oem help with the password encryption process. Since encryption is a on-to function (or a surjection - see http://mathworld.wolfram.com/Surjection.html) two of the cs5.5 oem same words will encrypt to the same ciphertext. This means on a cs5.5 oem system with very large amount of user there will be a cs5.5 oem chance someone will use some very bad passwords (like “password” etc) and it will shows as two identical ciphertext in the shadow file.
Salt is cs5.5 oem mostly unique to each user. It is often the encryption of the cs5.5 oem time the user is added to the system (thus relatively unique for each user). This salt is cs5.5 oem mixed with the user password before we start the encryption. This means for cs5.5 oem any given two users it is extremely unlikely that they are cs5.5 oem BOTH added to the system at the same time and use the cs5.5 oem same password.
Simply put, salts allow the cs5.5 oem system to afford users to use the same passwords without having two identical encrypted passwords in its password file.
3. Note about writing programs on linux that uses crypt()
crypt is standard to most c/c++ compilers on linux system. This means you don’t even have to do #include <> in your program to use these functions.
Example program:
#include <iostream>
int main()
{
std::cout<<crypt(”kccL;pw_d:”,”$1$TMVRB39B”);
return 0;
}
When compiled on linux system (with GNU cryptography library installed) you would run:
[lubox@neo 3]$ g++ hw3.cpp -o o -lcrypt
Notice the cs5.5 oem -lcrypt option at the end. This will tell the compiler that cs5.5 oem you are using crypt function.
The above program when run will yield output:
$1$TMVRB39B$PUaDAsZctLWtj0kteqvBe1
with the cs5.5 oem salt the same, and the password is encrypted into the preceding bold part.
4. …
