69 lines
2.2 KiB
Diff
69 lines
2.2 KiB
Diff
|
diff -up yp-tools-2.12/man/yppasswd.1.in.hash yp-tools-2.12/man/yppasswd.1.in
|
||
|
|
--- yp-tools-2.12/man/yppasswd.1.in.hash 2011-09-09 16:18:49.469037058 +0200
|
||
|
|
+++ yp-tools-2.12/man/yppasswd.1.in 2011-09-09 16:20:19.101030930 +0200
|
||
|
|
@@ -81,6 +81,12 @@ for authentication with the
|
||
|
|
.BR yppasswdd (8)
|
||
|
|
daemon. Subsequently, the
|
||
|
|
program prompts for the updated information:
|
||
|
|
+.P
|
||
|
|
+If we use shadowing passwords using passwd.adjunct, SHA-512 will be
|
||
|
|
+used for hashing a new password by default. If we want to use MD5,
|
||
|
|
+SHA_256 or older DES, we need to set the environment variable
|
||
|
|
+YP_PASSWD_HASH. Possible values are "DES", "MD5", "SHA-256" and
|
||
|
|
+"SHA-512" (value is case-insensitive).
|
||
|
|
.\"
|
||
|
|
.\"
|
||
|
|
.IP "\fByppasswd\fP or \fB-p\fP"
|
||
|
|
diff -up yp-tools-2.12/src/yppasswd.c.hash yp-tools-2.12/src/yppasswd.c
|
||
|
|
--- yp-tools-2.12/src/yppasswd.c.hash 2011-09-09 16:20:35.360029823 +0200
|
||
|
|
+++ yp-tools-2.12/src/yppasswd.c 2011-09-09 16:25:21.589010245 +0200
|
||
|
|
@@ -514,6 +514,32 @@ create_random_salt (char *salt, int num_
|
||
|
|
close (fd);
|
||
|
|
}
|
||
|
|
|
||
|
|
+
|
||
|
|
+/*
|
||
|
|
+ * Reads environment variable YP_PASSWD_HASH and returns hash id.
|
||
|
|
+ * Possible values are MD5, SHA-256, SHA-512 and DES.
|
||
|
|
+ * If other value is set or it is not set at all, SHA-512 is used.
|
||
|
|
+ */
|
||
|
|
+static int
|
||
|
|
+get_env_hash_id()
|
||
|
|
+{
|
||
|
|
+ const char *v = getenv("YP_PASSWD_HASH");
|
||
|
|
+ if (!v)
|
||
|
|
+ return SHA_512;
|
||
|
|
+
|
||
|
|
+ if (!strcasecmp(v, "DES"))
|
||
|
|
+ return DES;
|
||
|
|
+
|
||
|
|
+ if (!strcasecmp(v, "SHA-256"))
|
||
|
|
+ return SHA_256;
|
||
|
|
+
|
||
|
|
+ if (!strcasecmp(v, "MD5"))
|
||
|
|
+ return MD5;
|
||
|
|
+
|
||
|
|
+ return SHA_512;
|
||
|
|
+}
|
||
|
|
+
|
||
|
|
+
|
||
|
|
int
|
||
|
|
main (int argc, char **argv)
|
||
|
|
{
|
||
|
|
@@ -723,6 +749,15 @@ main (int argc, char **argv)
|
||
|
|
|
||
|
|
hash_id = get_hash_id (pwd->pw_passwd);
|
||
|
|
|
||
|
|
+ /* If we use passwd.adjunct, there is no magic value like $1$ in the
|
||
|
|
+ * beginning of password, but ##username instead. Thus, SHA_512 will be
|
||
|
|
+ * used for hashing a new password by default. If we want to use DES,
|
||
|
|
+ * MD5 or SHA_256, we need to set the environment variable
|
||
|
|
+ * YP_PASSWD_HASH (e.g. YP_PASSWD_HASH=DES).
|
||
|
|
+ */
|
||
|
|
+ if (strncmp(pwd->pw_passwd, "##", 2) == 0)
|
||
|
|
+ hash_id = get_env_hash_id();
|
||
|
|
+
|
||
|
|
/* Preserve 'rounds=<N>$' (if present) in case of SHA-2 */
|
||
|
|
if (hash_id == SHA_256 || hash_id == SHA_512)
|
||
|
|
{
|