And yes, I think we've got a really great demonstration for you to watch,
but also follow through as we take a look at how
user authentication works in Linux.
So I'm going to make sure we've got users with the password.
We can then read our password hash and compare the information
being submitted by a user during authentication.
To begin with,
let's go through and just elevate our privilege to save
me having to use the sudo command.
We know that we have a password for our vagrant user.
If you haven't got a password for one of your users,
just make sure you have got a password set.
If I go through and just use the getent command,
we can go through and say getent and then shadow,
taking a look at then our vagrant user.
As we go through and take a look at the second field,
the password field,
we've got three $ that actually separate the elements of the password.
Now I'm a very big fan of you using the awk command,
getting used to some of our standard, powerful tools.
If we specify that the file separator that we are looking at is a $,
we can start splitting up our password.
We can search for our vagrant accounts of /vagrant/.
We can open up our brace brackets, the brace brackets are
specifying the command that we want to do,
and we can print static text, as well as fields from the file.
So we're going to go through then and print out,
first of all, a little bit of static text.
We're just going to use alg, algorithm, colon, and a space.
These are all in double quotes inside of our awk statement.
We can then print field 2.
Field 2 will be using then the $ separator looking at the
information coming after the first $ symbol.
So this is going to be the algorithm, hence, we use the word algorithm.
We can then print a new line, nsalt, as static text.
Now we want to go through and print out our third field,
so information coming after the second $ symbol.
So we can go through and put $3 so that then we'll print the random salt.
It's still clear text.
Printing it on separate lines is going to make it
just that easier for us to read.
We can then go through and do another new line.
And now, we're onto our actual password hash.
This is the encrypted element of our password,
and it's going to show as then $4, our fourth field.
Remember, we're looking at information being separated by the $,
so we're looking at information coming after our third $ symbol.
We enclose off our brace brackets, close off our quotes,
and then don't forget to go through and open up the etc and shadow file.
It's very easy to forget to put the file name we think we've typed so much.
But then, as we look at the information, our first field then contains the 6.
This represents our algorithm, which is SHA‑512.
We then have our salt.
Salt is random text, might look encrypted,
but this is not encrypted information, it's just random text.
It has to be in clear text.
Finally, we have our password, the encrypted password, or the one‑way hash.
I can't tell a user what their password is.
This password is not decryptable.
So we can see it from the shadow file,
but we can compare to what we see printed out from our awk command.
Now obviously,
we've got some extra fields because we were using the $ as our field separator,
and we don't have any more $ once we're actually past that password field.
But obviously, we can drill back to see the information that we require.
Well, this is all very good and _____, but exactly how am I going to use this?
We'll take a look at this, the openssl command.
If I go through and use the passwd module with this,
I can specify the algorithm that I want to use.
So when we check our passwd information, we were using the algorithm 6 SHA‑512.
We can go through and specify the salt.
This is, again, clear text information that I can extract from my shadow file,
so make sure that I'm pasting it in exactly as is stored,
and then provide the password.
This is what happens during authentication.
I then look at the returned hash and then compare the hash,
against the hash, against the user.
We can look very quickly and see that the password itself begins with Cfc,
so that's a good start.
And when we go through and take a look at the end of it, we've got v7u1.
Now, of course, a computer can easily check,
but it's not so easy for us to check.
But I'm guessing if the beginning and end are correct,
then the whole hash is correct.
If I go back, though, with one password incorrect,
we can see that we get a completely different password coming back,
so we would fail authentication.
So we can start digging into how our passwords work and
understanding how authentication is going to work for us.
But if we up arrow key and then go through and supply a password,
but without a salt, we're allowing the system to generate a salt.
The nice thing is even though I'm using the same password,
we're getting a completely different password hash coming back each time.
This is really important because then, even though users may
still have the standard and default password,
there is no way even an administrator can go through and take a
look at that information and determine that all of the passwords
are the same because the data is completely different because the
salt is completely different.
So everything is really working well for us in an automated setup so
that we get strong passwords without being able to divulge any information by looking at the password hash.