Something else that you're going to have to deal with within your
career is the fact that documentation might not be quite as accurate or
as worded as well as it could be, so documentation might be wrong. When
taking a look at managing user passwords, we can demonstrate how a
password works and how authentication works by using the openssl and
passwd subcommand.
Now for the purpose of demonstration, I'm using ‑1, a relatively weak
algorithm, but that gives me a short hash for the password.
I'm entering the password here of Password1.
If I don't provide something called a salt, random characters,
then a salt will be generated automatically.
And that's usually what I want when I'm creating a password
because then that means if I have five or six users that
have the same default password,
I can't tell that they have the same password because each of
the passwords is going to be different.
If I provide though the salt, normally the salt is going to
be required when we're authenticating a user, but not when
I'm setting a user's password.
If I set a user's password this way,
then everyone who has the password, Password1, will have exactly
the same password hash, and it's very easy to tell then those
users that have the default password, and that's something we
would normally want to avoid.
Now later on in this CompTIA series, we will go through and take a look
at automating system administration, and we're going to see the
documentation provided with Ansible advises you to go through and when
generating a password to provide the salt.
That is probably not the best way of doing it because, say, every time
we go through then and generate a password that way, the password is
going to have exactly the same hash value.
It's going to be very easy to detect users who haven't yet
changed from the default system assigned password.
So try to avoid setting a salt when configuring the password.
But why don't we go through to our command line now just to see this
and get the idea of what we mean about the salt and how passwords
are authenticated? Now the first thing is we're just looking at the
documentation of how to generate an encrypted password for the
Ansible user module.
As I say,
there will be another course where we take a look at
Ansible for the new CompTIA Linux+.
But here they include the salt.
If we exclude the salt,
a random salt will be generated, and that's going to be far
more secure. Using the same salt value,
you're going to get exactly the same password.
We're still working on our Ubuntu system at the
moment, and we can see how this works.
If I go through and use openssl and the passwd subcommand,
we're going to use an MD5 algorithm.
It works better for the demonstration because the password is
shorter, and I'm going to use then Password1 as my password. This
password hash is irreversible encryption.
It can't be decrypted, so we can't tell what the password is, but there are
some elements that are clear text. That is important.
First element here is the algorithm that we've used.
So one is our MD5 algorithm. More normal on Linux, it
would have a value of 6, being SHA‑512.
Then we have the random salt that was generated.
Then we have our hashed password.
If I go through and run exactly the same thing again, because the salt is now
different, we're getting a different password each time.
The reason why though the salt is important, if I want to authenticate,
remember we can't decrypt our password, so we can only compare hashed values.
If I wanted to check the password that this user was supplying was
correct, I can go through, read the password value, and from that
password value, I can see what the salt is.
So I can read the algorithm, and I can read the salt.
If I then go through and put the salt in, so I'm just
copying it here, pasting that in.
Now when we run through, you can see that we're getting
exactly the same password hash coming back.
And of course, if I run it multiple times,
I'm going to go exactly the same hash value coming back. Supplying of
our salt is there for authenticating passwords.
We shouldn't be supplying the salt when we're generating
passwords. We generate a password without supplying the
salt, so we have a random salt. A random salt then is going to generate a random password hash.