what is the max permissible length of password on unix/linux system?
migrated from stackoverflow.com Jun 4 '10 at 21:59
This question came from our site for professional and enthusiast programmers.
If your system uses a cryptographic hash to store passwords i.e. MD5, SHA1, etc then there is no limit to the password length itself since these hashes can be created with any amount of data. An MD5 or SHA1 hash can be created for an entire hard drive and this is commonly done for forensic purposes because if even one bit is changed ever so slightly then you have a very different hash and hence you can verify the data has changed. This means you can use these exact same algorithms to test if data has been tampered with. Linux (current Linux at least) uses these same hash functions. It will ask you for a password and it will then create a cryptographic hash of the password you gave and see if this hash matches the stored password. This also means that your passwords are not stored in plain text and the only way to recover a lost password is to run a brute force test which generates password hash after password hash until a it finds one which matches the current hash and then you have your password.
There is a slight downside to using these hashes which is that a hash has a finite size for example an MD5 hash is 128 bit. This means that an MD5 hash only has
The way you can tell if your system uses cryptographic hashes to store passwords is take a look at the
So you know, the numbers mean this:
SHA-512 is the best available hash to use that glibc offers. I don't know how strong blowfish is but it is not part of glibc and therefor is only available on certain distributions that have added it. SHA-512 produces 512 bit keys or 2^512 possible combinations before a collision can be expected and with a complex enough password, it would take a cluster of computers a very very long time to find either the actual password or a collision in the hash.
Also, if you have a hash which does not start with
So you know, Ubuntu as of 8.04, which was released in April 2008, used MD5 hashes. Ubuntu from 8.10, which was released in October 2008, and all versions since then use SHA-512 hashes. I don't know how far before April 2008 but I believe for several years if not more, most all distributions used hashes.
Current 12.04 and 14.04 LTS (long term support releases) of Ubuntu appear to use SHA-512 by default, as can be seen with the
Now the length the key or password allowed for any hashing algorithm isn't the only thing to determine what size password you are allowed to have. The other item of interest is how the program is written and what length program itself will support. All modern passwd programs and probably most the
This should answer your question as to how long a password can be. Hope I helped.
It depends on which authentication module is used. In modern Linux systems, there is no maximum limit on password length. Some obsolete systems might have limits imposed by their password storage system -- popular maximums seem to be 8, 40, and 255.
Depending on how the password is stored, MD5, SHA1, BlowFish etc I think there is no limit on password set by the storage method itself.
Older implementations might have a limit that is probably 8 or 255 characters.
This does seem like a question better suited for www.serverfault.com though :)