-
Bug
-
Resolution: Unresolved
-
Undefined
-
rhel-9.5
-
None
-
shadow-utils-4.9-12.el9
-
Yes
-
Low
-
rhel-sst-idm-sssd
-
ssg_idm
-
None
-
False
-
-
None
-
None
-
Pass
-
Automated
-
-
All
-
None
Description of problem:
When using chpasswd to set the user's password, the value and format of salt in /etc/shadow is incorrect, it is rounds=5000 all the time for different users/passwords.
#getent shadow test1
test1:$6$rounds=5000$QLS4e/jK8y/AMfp$8Tsha8ea8dcFZ.2PxB0Kb0S6Fs2hNnSP8y1JFadoZICoq3xCdBVVLymOytdzjCDU6fprdyTN27Ku7SrrK8Lb3.:19676:0:99999:7:::
Found below config in rhel8.10 (no in rhel8.9):
#cat /etc/login.defs | grep SHA_CRYPT_MAX_ROUNDS
SHA_CRYPT_MAX_ROUNDS 5000
And if remove this line, the issue disappears.
RHEL Version:
shadow-utils-4.9-10.el9_5
How reproducible:
100%
Steps to Reproduce:
1. Launch instance with latest rhel-8.10 qcow2 image
2. Login instance, add two users test1 and test2, then chpasswd
#useradd test1
#useradd test2
#echo test1:redhat2023 | chpasswd
#echo test2:1234redhat | chpasswd
3. Check the /etc/shadow
#getent shadow
test1:$6$rounds=5000$YxSw0/GVW$hSzM.q/bvGZ2Xnhwx2VeSBQKVPzAed.pc2NZpuSECu71gIartT3jWUoB9gVZVWkwKe4L4pCCzI8C7t5jBMWRV1:0:0:99999:7:::
test2:$6$rounds=5000$QLS4e/jK8y/AMfp$8Tsha8ea8dcFZ.2PxB0Kb0S6Fs2hNnSP8y1JFadoZICoq3xCdBVVLymOytdzjCDU6fprdyTN27Ku7SrrK8Lb3.:19676:0:99999:7:::
Actual results:
The salt in shadow is rounds=5000 for both test1 and test2, and the format rounds=5000 is incorrect
Expected results:
The salt in shadow should be random like below format:
#getent shadow
test1:$6$mLGIX/vYV3$raP6p3HW5r4R/maDe2aXg1Gj30ctizT3Vk.7TT3qXyDitR1u9yfTm0E4unWqBl35aVilvSXXDA2hpBVPdBu8q1:0:0:99999:7:::
test2:$6$kq3og/sxCo$CFNLITerw8jPJKc.LtZKuWdt.c0Eev2HB6kQCUA9np3TxZhR3JAD/0HJGPhj3MBRLRkRY57yMlsoLDcG4D2lZ0:19676:0:99999:7:::
- duplicates
-
RHEL-16668 The value and format of salt in /etc/shadow is incorrect when chpasswd
- Closed
- links to
-
RHBA-2024:142280 shadow-utils update