In /etc/shadow I have entries such as admin:YtChlvAGYzva2:16318:0:99999:7:::. I know the original password and would like to generate the same hash somehow. However, running openssl passwd -crypt password gives me different results every time I run it. I assume salt is involved, so where can I find the salt used to create the original hash?

Edit: I got the original hash using the following command:

openssl passwd -crypt -salt Yu password

The salt and the encrypted password are both mashed into the string YtChlvAGYzva2.

From the Shadow Password Howto:

When a user picks or is assigned a password, it is encoded with a randomly generated value called the salt. This means that any particular password could be stored in 4096 different ways. The salt value is then stored with the encoded password.

When a user logs in and supplies a password, the salt is first retrieved from the stored encoded password.

The longer password strings you see with modern systems separate the hash using $. But for the older systems, it was just mashed in (Wikipedia):

Earlier versions of Unix used a password file (/etc/passwd) to store the hashes of salted passwords (passwords prefixed with two-character random salts). In these older versions of Unix, the salt was also stored in the passwd file (as cleartext) together with the hash of the salted password.

In your example, I believe that the salt is "Yt" and the encrypted password is "ChlvAGYzva2". It's literally the first two characters of the string.

  • Can I separate them somehow? – JohnEye Oct 6 '14 at 20:03
  • 1
    @JohnEye Use the substring methods of your favorite script/language? – schroeder Oct 6 '14 at 20:09
  • Thank you, I was able to get the original hash using openssl passwd -crypt -salt Yu password. – JohnEye Oct 6 '14 at 20:09
  • @schroeder: I asked this before OP changed the post :-) – JohnEye Oct 6 '14 at 20:10
  • 1
    And... what was the salt? First two characters (Yt) of the hash as stated by gowenfawr? – Aydin K. Aug 30 '16 at 8:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.