Here's something that GnuPG can't do. OpenSSL has a built-in command for creating encrypted Linux passwords exactly like those made by /bin/passwd.
Skip this paragraph to avoid pedantic cryptography. Although commonly called encrypted, Linux passwords are actually hashed using either MD5 or the old UNIX password hash (based on the DES encryption algorithm). This allows Linux not to know your password even though it knows when you provide the correct password. When you set your password, Linux hashes your password and stores it in /etc/shadow. When you log in, Linux takes the password you provide and hashes it again, and then compares that hash to what's stored in /etc/shadow for your account. If they match, you provided the correct password and can log in. If they don't match, you don't know your password, and because only the hash was stored, the computer still doesn't know your password either.
Here's why making your own password hash is useful. Let's say you need a new password on another computer. Perhaps it's a new account or you forgot the old password and asked the system administrator to reset it for you. If you can talk to the sysadmin in person, this works well, but what if the sysadmin is somewhere else? Perhaps you've never even met your sysadmin. How do you communicate your new password? E-mail is not secure at all, and telephones are scarcely better. Postal mail takes days (and has other security problems). Fax machines, text messaging and most pagers aren't secure either.
It gets worse. Maybe you don't even trust that sysadmin. Sure, the sysadmin usually has root, but someone else knowing your password bypasses even root accountability. Maybe you want to use the same password on other computers, and you don't trust those sysadmins either.
So, do this instead:
$ openssl passwd -1 Password: Verifying - Password: $1$zmUy5lry$aG45DkcaJwM/GNlpBLTDy0
Enter your new password twice; it won't echo. If you have multiple accounts, run the above example multiple times. The output is the cryptographic hash of your password. The hash is randomly salted so that every time it's run, the output will be different, even if the password is the same.
In my example, the password hash is:
Your password hash probably will be completely different, except for the initial $1$.
This password hash can now be e-mailed, faxed, text messaged or even spoken over the phone to a sysadmin to set as your password hash.
After the sysadmin receives your password hash, it can be entered into /etc/shadow manually or with chpasswd. The latter requires a temporary new file, call it newpassword, with your loginid and password hash like this:
The file can contain multiple lines for other accounts too.
Then, the sysadmin runs this as root:
chpasswd --encrypted < newpassword
Now, the new password is set. It's a good idea to change your password once you log in, unless you use a really strong passphrase. This is because the password hash, once exposed, is subject to off-line brute-force attacks, unless the password is really long.
This method of resetting passwords can be quite secure. For example, using this technique, someone could take the password hash published above, create an account, then tell the person the loginid and hostname and that the password hash above was used. Only the person who originally created the password hash could know the password, even though the password hash was published in a magazine.
By the way, the password for that hash is 28 completely random base64 characters long, so it should be extremely difficult to crack. But please, don't create any accounts with that hash because the password is also published, it's:
That password and hash were created like this:
$ openssl rand 21 -base64 HXzNnCTo8k44k8v7iz4ZkR/QWkM2 $ openssl passwd -1 HXzNnCTo8k44k8v7iz4ZkR/QWkM2
These examples use the MD5 password hashes now common on Linux systems. If you need to use the old UNIX password hash, simply leave off the -1. For example:
$ openssl passwd Password: Verifying - Password: xcx7DofWC0LpQ
The password for this last password hash example is: TheLinux.
The many algorithms that OpenSSL supports makes it well suited for cryptographic benchmarking. This is useful for comparing the relative performance of different cryptographic algorithms and different hardware architectures using a consistent code base. And, it has a built-in benchmarking command.
The openssl speed command, by default, runs through every single algorithm in every single supported mode and option, with several different sizes of data. The different sizes are important because of algorithm start-up overhead.
A complete speed run takes about six minutes, regardless of hardware performance, and produces 124 lines of performance data with 29 lines of summary.
However, note that cryptographic algorithm performance is extremely dependent on the specific implementation. For higher performance, OpenSSL has x86 assembly code for several algorithms. Other architectures, such as ia64, SPARC and x86-64, have much less assembly code, and most others have none. The assembly code is located in these OpenSSL source code directories: crypto/*/asm. Excerpts of the speed report for three different systems are shown in Tables 2 and 3.
Table 2. Hash and Block Cipher Performance (The numbers are in 1,000s of bytes per second using 1,024-byte blocks.)
|AMD K6-2 300MHz, Linux 2.6.12, OpenSSL 0.9.7g||AMD Athlon 1.333GHz, Linux 2.4.27, OpenSSL 0.9.7d||PowerMac G5 1.6GHz, Darwin Kernel Version 8.0.0, OpenSSL 0.9.7b|
Table 3. Public Key Crypto Performance
|rsa 1024 bits||30.8||563.1||AMD K6-2 300MHz, Linux 2.6.12, OpenSSL 0.9.7g|
|dsa 1024 bits||61.6||50.7||AMD K6-2 300MHz, Linux 2.6.12, OpenSSL 0.9.7g|
|rsa 1024 bits||239.9||4,514.6||AMD Athlon 1.333 GHz, Linux 2.4.27, OpenSSL 0.9.7d|
|dsa 1024 bits||498.2||410.6||AMD Athlon 1.333 GHz, Linux 2.4.27, OpenSSL 0.9.7d|
|rsa 1024 bits||148.8||2,739.1||PowerMac G5 1.6 GHz, Darwin Kernel Version 8.0.0, OpenSSL 0.9.7b|
|dsa 1024 bits||289.5||234.6||PowerMac G5 1.6 GHz, Darwin Kernel Version 8.0.0, OpenSSL 0.9.7b|
|Speed Up Your Web Site with Varnish||Jun 19, 2013|
|Non-Linux FOSS: libnotify, OS X Style||Jun 18, 2013|
|Containers—Not Virtual Machines—Are the Future Cloud||Jun 17, 2013|
|Lock-Free Multi-Producer Multi-Consumer Queue on Ring Buffer||Jun 12, 2013|
|Weechat, Irssi's Little Brother||Jun 11, 2013|
|One Tail Just Isn't Enough||Jun 07, 2013|
- Speed Up Your Web Site with Varnish
- Containers—Not Virtual Machines—Are the Future Cloud
- Non-Linux FOSS: libnotify, OS X Style
- Lock-Free Multi-Producer Multi-Consumer Queue on Ring Buffer
- Linux Systems Administrator
- Senior Perl Developer
- Technical Support Rep
- UX Designer
- Android's Limits
- Reply to comment | Linux Journal
1 min 53 sec ago
- Yeah, user namespaces are
1 hour 18 min ago
- Cari Uang
4 hours 49 min ago
- user namespaces
7 hours 43 min ago
8 hours 8 min ago
- One advantage with VMs
10 hours 37 min ago
- about info
11 hours 10 min ago
11 hours 11 min ago
11 hours 12 min ago
11 hours 14 min ago
Free Webinar: Hadoop
How to Build an Optimal Hadoop Cluster to Store and Maintain Unlimited Amounts of Data Using Microservers
Realizing the promise of Apache® Hadoop® requires the effective deployment of compute, memory, storage and networking to achieve optimal results. With its flexibility and multitude of options, it is easy to over or under provision the server infrastructure, resulting in poor performance and high TCO. Join us for an in depth, technical discussion with industry experts from leading Hadoop and server companies who will provide insights into the key considerations for designing and deploying an optimal Hadoop cluster.
Some of key questions to be discussed are:
- What is the “typical” Hadoop cluster and what should be installed on the different machine types?
- Why should you consider the typical workload patterns when making your hardware decisions?
- Are all microservers created equal for Hadoop deployments?
- How do I plan for expansion if I require more compute, memory, storage or networking?