On my RHEL6 linux is configured to use MD5 password hashing is the linux usage of MD5 for password hashing considered secure?
While MD5 still maintains its preimage resistance for practical purposes (given the hash, it is difficult to obtain the message), it has a big flaw when used for authentication: its quickness.
Short passwords can be easily discovered, using either a rainbow table (a list containing many common passwords and their respective hashes) or simply a brute-force attack (trying all possible passwords). Modern desktop computers are very good at this. Commercial programs that use your GPU to try multiple passwords in parallel can try billions of passwords per second.
This problem can be solved easily by choosing a password that is long and/or complex enough. Slower algorithms could achieve the same security level with weaker passwords.
Also, an attacker needs either shadow privileges or physical access to the hard drive in order to read the contents of