Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-16668

The value and format of salt in /etc/shadow is incorrect when chpasswd

    • Icon: Bug Bug
    • Resolution: Done-Errata
    • Icon: Undefined Undefined
    • rhel-8.10
    • rhel-8.10
    • shadow-utils
    • None
    • shadow-utils-4.6-22.el8
    • sst_idm_sssd
    • ssg_idm
    • 12
    • 13
    • None
    • QE ack
    • False
    • Hide

      None

      Show
      None
    • No
    • None
    • None

      Description of problem:
       
      When using chpasswd to set the user's password, the value and format of salt in /etc/shadow is incorrect, it is rounds=5000 all the time for different users/passwords.
       

      #getent shadow test1
      test1:$6$rounds=5000$QLS4e/jK8y/AMfp$8Tsha8ea8dcFZ.2PxB0Kb0S6Fs2hNnSP8y1JFadoZICoq3xCdBVVLymOytdzjCDU6fprdyTN27Ku7SrrK8Lb3.:19676:0:99999:7:::
       
      Found below config in rhel8.10 (no in rhel8.9):

      #cat /etc/login.defs | grep SHA_CRYPT_MAX_ROUNDS
      SHA_CRYPT_MAX_ROUNDS 5000
       
      And if remove this line, the issue disappears.
       
       
      RHEL Version:
      Red Hat Enterprise Linux 8.10 
      kernel-4.18.0-521.el8.x86_64
      shadow-utils-4.6-21.el8.x86_64
       
       
      How reproducible:
      100%
       

      Steps to Reproduce:
      1. Launch instance with latest rhel-8.10 qcow2 image
      2. Login instance, add two users test1 and test2, then chpasswd

      #useradd test1

      #useradd test2

      #echo test1:redhat2023 | chpasswd

      #echo test2:1234redhat | chpasswd
      3. Check the /etc/shadow

      #getent shadow
      test1:$6$rounds=5000$YxSw0/GVW$hSzM.q/bvGZ2Xnhwx2VeSBQKVPzAed.pc2NZpuSECu71gIartT3jWUoB9gVZVWkwKe4L4pCCzI8C7t5jBMWRV1:0:0:99999:7:::
      test2:$6$rounds=5000$QLS4e/jK8y/AMfp$8Tsha8ea8dcFZ.2PxB0Kb0S6Fs2hNnSP8y1JFadoZICoq3xCdBVVLymOytdzjCDU6fprdyTN27Ku7SrrK8Lb3.:19676:0:99999:7:::
       
       
      Actual results:

      The salt in shadow is rounds=5000 for both test1 and test2, and the format rounds=5000 is incorrect
       
      Expected results:
      The salt in shadow should be random like below format:

      #getent shadow
      test1:$6$mLGIX/vYV3$raP6p3HW5r4R/maDe2aXg1Gj30ctizT3Vk.7TT3qXyDitR1u9yfTm0E4unWqBl35aVilvSXXDA2hpBVPdBu8q1:0:0:99999:7:::
      test2:$6$kq3og/sxCo$CFNLITerw8jPJKc.LtZKuWdt.c0Eev2HB6kQCUA9np3TxZhR3JAD/0HJGPhj3MBRLRkRY57yMlsoLDcG4D2lZ0:19676:0:99999:7:::
       
      Additional info:
      1. No such issue in rhel-8.9(shadow-utils-4.6-19.el8.x86_64) and rhel-9.4
      2. No such issue when using passwd to set user's password
       

            ipedrosa@redhat.com Iker Pedrosa
            rhn-support-huzhao Huijuan Zhao
            Iker Pedrosa Iker Pedrosa
            Anuj Borah Anuj Borah
            Votes:
            0 Vote for this issue
            Watchers:
            10 Start watching this issue

              Created:
              Updated:
              Resolved: