patchTiger UNIX security tool - Patches: patch #7675, Fixes for hashing algorithm...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

patch #7675: Fixes for hashing algorithm detection

Submitter:  pyllyukko <pyllyukko>
Submitted:  Wed 23 Nov 2011 08:04:43 PM UTC
   
 
Category:  Security test Priority:  5 - Normal
Status:  None Privacy:  Public
Assigned to:  None Open/Closed:  Open

Sun 21 Jan 2024 09:20:28 AM UTC, comment #1: 

Nowadays Debian also has:

  • yescrypt "$y$"
  • gost-yescrypt "$gy$"
  • scrypt "$7$"
  • bcrypt "$2b$"
pyllyukko <pyllyukko>
Wed 23 Nov 2011 08:04:43 PM UTC, original submission:  

Timo's SHA-512 patch (#7186) didn't work for me. There's a few problems when dealing with SHA hashes in the shadow file. First, the length of the salt varies, at least on my box with shadow suite 4.1.4.3 the length is randomized.

We can see it in libmisc/salt.c:
/*

  • Return the salt size.
  • The size of the salt string is between 8 and 16 bytes for the SHA crypt
  • methods.

 */

And I can confirm this by running something like the following on my box:
awk -F'$' '/\$6/{print length($4)}' /etc/shadow

The string in shadow might also include the "rounds syntax", when you have modified the SHA_CRYPT_(MIN|MAX)_ROUNDS in login.defs. The hash strings migtht look like this: "$6$rounds=<integer>$<salt>$<hash>".

That's why it's hard to write a precise pattern in Bash, at least with case, when you can't use regular expressions. When the hashing algorithm is not properly detected, Tiger might give you false positives such as pass014w (it thinks the account is locked/disabled when it isn't) and false negative for pass013w.

So here is my suggestion to fix this, a generic matching for only the hashing algorithm id. I also included few missing algorithms from man 3 crypt and one more string to indicate locked account, even though it's catched by the asterisk.

pyllyukko <pyllyukko>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #24437:  zappasswd-3.2.3.patch added by pyllyukko (1KiB - text/x-diff)
file #24438:  zappasswd.patch added by pyllyukko (3KiB - text/x-diff)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by pyllyukko (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2011-11-23 pyllyukko Attached File- Added zappasswd-3.2.3.patch, #24437
        Attached File- Added zappasswd.patch, #24438

    Back to the top

    Powered by Savane 3.13-cf05.
    Corresponding source code