-
Bug
-
Resolution: Done-Errata
-
Undefined
-
rhel-8.10
-
None
-
shadow-utils-4.6-22.el8
-
None
-
None
-
rhel-sst-idm-sssd
-
ssg_idm
-
12
-
13
-
0
-
QE ack
-
False
-
-
No
-
None
-
Pass
-
Automated
-
None
Description of problem:
When using chpasswd to set the user's password, the value and format of salt in /etc/shadow is incorrect, it is rounds=5000 all the time for different users/passwords.
#getent shadow test1
test1:$6$rounds=5000$QLS4e/jK8y/AMfp$8Tsha8ea8dcFZ.2PxB0Kb0S6Fs2hNnSP8y1JFadoZICoq3xCdBVVLymOytdzjCDU6fprdyTN27Ku7SrrK8Lb3.:19676:0:99999:7:::
Found below config in rhel8.10 (no in rhel8.9):
#cat /etc/login.defs | grep SHA_CRYPT_MAX_ROUNDS
SHA_CRYPT_MAX_ROUNDS 5000
And if remove this line, the issue disappears.
RHEL Version:
Red Hat Enterprise Linux 8.10
kernel-4.18.0-521.el8.x86_64
shadow-utils-4.6-21.el8.x86_64
How reproducible:
100%
Steps to Reproduce:
1. Launch instance with latest rhel-8.10 qcow2 image
2. Login instance, add two users test1 and test2, then chpasswd
#useradd test1
#useradd test2
#echo test1:redhat2023 | chpasswd
#echo test2:1234redhat | chpasswd
3. Check the /etc/shadow
#getent shadow
test1:$6$rounds=5000$YxSw0/GVW$hSzM.q/bvGZ2Xnhwx2VeSBQKVPzAed.pc2NZpuSECu71gIartT3jWUoB9gVZVWkwKe4L4pCCzI8C7t5jBMWRV1:0:0:99999:7:::
test2:$6$rounds=5000$QLS4e/jK8y/AMfp$8Tsha8ea8dcFZ.2PxB0Kb0S6Fs2hNnSP8y1JFadoZICoq3xCdBVVLymOytdzjCDU6fprdyTN27Ku7SrrK8Lb3.:19676:0:99999:7:::
Actual results:
The salt in shadow is rounds=5000 for both test1 and test2, and the format rounds=5000 is incorrect
Expected results:
The salt in shadow should be random like below format:
#getent shadow
test1:$6$mLGIX/vYV3$raP6p3HW5r4R/maDe2aXg1Gj30ctizT3Vk.7TT3qXyDitR1u9yfTm0E4unWqBl35aVilvSXXDA2hpBVPdBu8q1:0:0:99999:7:::
test2:$6$kq3og/sxCo$CFNLITerw8jPJKc.LtZKuWdt.c0Eev2HB6kQCUA9np3TxZhR3JAD/0HJGPhj3MBRLRkRY57yMlsoLDcG4D2lZ0:19676:0:99999:7:::
Additional info:
1. No such issue in rhel-8.9(shadow-utils-4.6-19.el8.x86_64) and rhel-9.4
2. No such issue when using passwd to set user's password
- is duplicated by
-
RHEL-58978 Regression: The value and format of salt in /etc/shadow is incorrect when chpasswd
- Integration
- links to
-
RHBA-2023:123381 shadow-utils bug fix and enhancement update
- mentioned on