Before I resume working on PAM (I need to implement a change to pam_lastlog to fix a pernicious bug), I wanted to just write a quick entry for the paranoid of you who still use PAM for system login.
Since, as you most likely already know, MD5 is once again considered insecure, one obvious concern would be the fact that passwords saved in MD5 on a system are not secure either. For this reason if you’re using Linux-PAM, you can make use of the SHA512 hashing of system password keys, which I already wrote about.
Remember that to use that you have to make sure your Linux-PAM (sys-libs/pam) is built against a recent enough version of glibc. Unfortunately the version of pambase with this feature hasn’t hit stable yet, the bug above is blocking it, and I’m going to have to hack at pam_lastlog to fix that.
What I didn’t write last time, is that you can easily spot if your system is using md5 passwords by using this simple command from root:
# fgrep '$1$' /etc/shadow
Of course one has to access your /etc/shadow file to breach your passwords, so your system has to have been compromised before, but it’s still not nice if they can find out what your basic passwords are.
Moving on.
“but it’s still not nice if they can find out what your basic passwords are” — there’s no known and published method that deduces a plaintext from its MD5 hash. There are some methods that can produce a plaintext which happens to have the same MD5 hash, but it’s very different from being able to construct an inverse function to this hash.
Sorry I forgot the sarcasm tag, if you check the title of the post is intended “for paranoids”, I certainly am not one 😉
Where is the sha512 USE flag you blogged about last August? Is glibc 2.6.1 recent enough? And does the pambase version you blogged above is in stable now?
The USE flag is in sys-auth/pambase, ~arch version of it, since I haven’t requested a stable for that just yet.What kept that unstable up to now was the double last login specification from SSH, which I now kinda solved. Kinda because for now I just disabled it SSH-side, without changing how pam_lastlog logs the ttys.I’m going to push everything for stable for next month hopefully.