Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-58978

Regression: The value and format of salt in /etc/shadow is incorrect when chpasswd

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • rhel-9.6
    • rhel-9.5
    • shadow-utils
    • None
    • shadow-utils-4.9-12.el9
    • Yes
    • Low
    • rhel-sst-idm-sssd
    • ssg_idm
    • None
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • All
    • None

      Description of problem:

      When using chpasswd to set the user's password, the value and format of salt in /etc/shadow is incorrect, it is rounds=5000 all the time for different users/passwords.

      #getent shadow test1
      test1:$6$rounds=5000$QLS4e/jK8y/AMfp$8Tsha8ea8dcFZ.2PxB0Kb0S6Fs2hNnSP8y1JFadoZICoq3xCdBVVLymOytdzjCDU6fprdyTN27Ku7SrrK8Lb3.:19676:0:99999:7:::

      Found below config in rhel8.10 (no in rhel8.9):

      #cat /etc/login.defs | grep SHA_CRYPT_MAX_ROUNDS
      SHA_CRYPT_MAX_ROUNDS 5000

      And if remove this line, the issue disappears.

      RHEL Version:
      shadow-utils-4.9-10.el9_5

      How reproducible:
      100%

      Steps to Reproduce:
      1. Launch instance with latest rhel-8.10 qcow2 image
      2. Login instance, add two users test1 and test2, then chpasswd

      #useradd test1

      #useradd test2

      #echo test1:redhat2023 | chpasswd

      #echo test2:1234redhat | chpasswd
      3. Check the /etc/shadow

      #getent shadow
      test1:$6$rounds=5000$YxSw0/GVW$hSzM.q/bvGZ2Xnhwx2VeSBQKVPzAed.pc2NZpuSECu71gIartT3jWUoB9gVZVWkwKe4L4pCCzI8C7t5jBMWRV1:0:0:99999:7:::
      test2:$6$rounds=5000$QLS4e/jK8y/AMfp$8Tsha8ea8dcFZ.2PxB0Kb0S6Fs2hNnSP8y1JFadoZICoq3xCdBVVLymOytdzjCDU6fprdyTN27Ku7SrrK8Lb3.:19676:0:99999:7:::

      Actual results:

      The salt in shadow is rounds=5000 for both test1 and test2, and the format rounds=5000 is incorrect

      Expected results:
      The salt in shadow should be random like below format:

      #getent shadow
      test1:$6$mLGIX/vYV3$raP6p3HW5r4R/maDe2aXg1Gj30ctizT3Vk.7TT3qXyDitR1u9yfTm0E4unWqBl35aVilvSXXDA2hpBVPdBu8q1:0:0:99999:7:::
      test2:$6$kq3og/sxCo$CFNLITerw8jPJKc.LtZKuWdt.c0Eev2HB6kQCUA9np3TxZhR3JAD/0HJGPhj3MBRLRkRY57yMlsoLDcG4D2lZ0:19676:0:99999:7:::

              ipedrosa@redhat.com Iker Pedrosa
              aborah@redhat.com Anuj Borah
              Iker Pedrosa Iker Pedrosa
              Anuj Borah Anuj Borah
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated: