Home / Questions / 48453
Accepted
jask
Asked: 2020-02-09 12:07:24 +0800 CST 2020-02-09 12:07:24 +0800 CST

Change user password having only the hash

  • 772

Good afternoon everyone!

Is there any way to change a password of a user in Linux only having its hash? That is, on another Linux machine I have generated a password for a user, copied the hash of the /etc/shadow file and pasted it on the other machine, would that be enough? I have done tests and it has not worked for me so I understand that it does not. I do this because I need to pass that hash to third parties so they can apply it in a Puppet and I don't want to pass the root password to them.

Thank you!

linux

2 Answers

  1. Best Answer

    It depends on the PAM configuration of both systems, which, in my Ubuntu, is stored in /etc/pam.d/passwd, which in turn is limited to loading /etc/pam.d/common-password, and suggests us to consult man pam_unix.

    In said /etc/pam.d/common-password, the important option is

    password        [success=1 default=ignore]      pam_unix.so obscure sha512

    If both systems use the same configuration, it's as easy as you suggest: copy the characters between the first and the second :, leaving the /etc/shadowso that:

    ...
user1:ñlakjsdfñasljfñajfslf:17086...
...
user2:ñlakjsdfñasljfñajfslf:19786...
...

    In that example, both users share the same password.

    It's also a good idea to check the /etc/passwd, just to make sure both users have active passwords using the shadow system :

    ...
user1:x:1997:...
...
user2:x:1998:...

    It is this file, the important thing is the , which indicates that the shadowx system is used for that user .

    In case the systems do not use the same configuration, things get quite complicated. You could reconfigure one of them, but that involves removing the current passwords to set others with the new settings.

    EDIT

    There are alternatives to what you intend: use sudo, use sshwith public/private key, ...

    • 2

  2. Passing the hash of a password contradicts the point of using a hash. If you give access with the direct hash, you open your system to any "man in the middle" attack, where third parties leak the hash and use it to access your system in an unauthorized way.

    • 1