Password hash in /etc/shadow weakens the security if /home encryption is enabledtransparent home directory encryptionIs /home encryption useful on a server?How do I get passwords from the keyring in the terminal for usage in scripts?How to decode the hash password in /etc/shadowDoes Home Encryption used in addition to Disk Encryption increase security?How do I update shadow file password hashes after changing the encryption method?Recover/change encryption password
How to respond when insulted by a grad student in a different department?
I'm largest when I'm five, what am I?
Make Leaflet polyline bold by hover?
My name was added to manuscript as co-author without my consent; how to get it removed?
SQL server backup message
"Kept that sister of his quiet" meaning
Can you use wish to cast a level 9 spell?
Fill a bowl with alphabet soup
SSH from a shared workplace computer
Modern warfare theory in a medieval setting
What are the consequences for downstream actors of redistributing a work under a wider CC license than the copyright holder authorized?
Why is CMYK & PNG not possible?
Is consistent disregard for students' time "normal" in undergraduate research?
Suspicious crontab entry running 'xribfa4' every 15 minutes
Print the sequence
Numbering like equations for regular text
Song in C major has F# note
What powers an aircraft prior to the APU being switched on?
What causes standard door hinges to close up to a certain amount automatically?
Can you decide not to sneak into a room after seeing your roll?
Did Feynman cite a fallacy about only circles having the same width in all directions as a reason for the Challenger disaster?
What is joint estimation?
What can I do to avoid potential charges for bribery?
I didn't do any exit passport control when leaving Japan. What should I do?
Password hash in /etc/shadow weakens the security if /home encryption is enabled
transparent home directory encryptionIs /home encryption useful on a server?How do I get passwords from the keyring in the terminal for usage in scripts?How to decode the hash password in /etc/shadowDoes Home Encryption used in addition to Disk Encryption increase security?How do I update shadow file password hashes after changing the encryption method?Recover/change encryption password
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty
margin-bottom:0;
Recently I have encrypted the /home folder with fscrypt, I know it uses Argon2 to derive the decryption key and it takes about a second to do so but I'm concerned about the password stored in /etc/shadow using SHA-512. The attacker can just brute force the password hashed with SHA-512 which would significantly speed up the brute-forcing process. So is it possible to use a stronger hashing algorithm in /etc/shadow if I still want to use the login passphrase as my decryption password?
password encryption security home-directory
asked Apr 21 at 15:55
Ignacy RuszpelIgnacy Ruszpel
1
add a comment
|
Recently I have encrypted the /home folder with fscrypt, I know it uses Argon2 to derive the decryption key and it takes about a second to do so but I'm concerned about the password stored in /etc/shadow using SHA-512. The attacker can just brute force the password hashed with SHA-512 which would significantly speed up the brute-forcing process. So is it possible to use a stronger hashing algorithm in /etc/shadow if I still want to use the login passphrase as my decryption password?
password encryption security home-directory
asked Apr 21 at 15:55
Ignacy RuszpelIgnacy Ruszpel
1
Are you sure that the hash in /etc/shadow is raw SHA-512, rather than sha512crypt ($6$) ? "Just brute force" varies - bcrypt/blowfish may be your best option (via PAM?), but sha512crypt isn't terrible, especially if you're using a random passphrase with sufficient entropy, such that bruteforcing for a slow hash like sha512crypt becomes infeasible.
– Royce Williams
Apr 21 at 18:34
add a comment
|
Recently I have encrypted the /home folder with fscrypt, I know it uses Argon2 to derive the decryption key and it takes about a second to do so but I'm concerned about the password stored in /etc/shadow using SHA-512. The attacker can just brute force the password hashed with SHA-512 which would significantly speed up the brute-forcing process. So is it possible to use a stronger hashing algorithm in /etc/shadow if I still want to use the login passphrase as my decryption password?
password encryption security home-directory
asked Apr 21 at 15:55
Ignacy RuszpelIgnacy Ruszpel
1
Recently I have encrypted the /home folder with fscrypt, I know it uses Argon2 to derive the decryption key and it takes about a second to do so but I'm concerned about the password stored in /etc/shadow using SHA-512. The attacker can just brute force the password hashed with SHA-512 which would significantly speed up the brute-forcing process. So is it possible to use a stronger hashing algorithm in /etc/shadow if I still want to use the login passphrase as my decryption password?
password encryption security home-directory
password encryption security home-directory
asked Apr 21 at 15:55
Ignacy RuszpelIgnacy Ruszpel
1
asked Apr 21 at 15:55
Ignacy RuszpelIgnacy Ruszpel
1
asked Apr 21 at 15:55
Ignacy RuszpelIgnacy Ruszpel
1
asked Apr 21 at 15:55
Ignacy RuszpelIgnacy Ruszpel
1
asked Apr 21 at 15:55
Ignacy RuszpelIgnacy Ruszpel
1
1
Are you sure that the hash in /etc/shadow is raw SHA-512, rather than sha512crypt ($6$) ? "Just brute force" varies - bcrypt/blowfish may be your best option (via PAM?), but sha512crypt isn't terrible, especially if you're using a random passphrase with sufficient entropy, such that bruteforcing for a slow hash like sha512crypt becomes infeasible.
– Royce Williams
Apr 21 at 18:34
add a comment
|
Are you sure that the hash in /etc/shadow is raw SHA-512, rather than sha512crypt ($6$) ? "Just brute force" varies - bcrypt/blowfish may be your best option (via PAM?), but sha512crypt isn't terrible, especially if you're using a random passphrase with sufficient entropy, such that bruteforcing for a slow hash like sha512crypt becomes infeasible.
– Royce Williams
Apr 21 at 18:34
Are you sure that the hash in /etc/shadow is raw SHA-512, rather than sha512crypt ($6$) ? "Just brute force" varies - bcrypt/blowfish may be your best option (via PAM?), but sha512crypt isn't terrible, especially if you're using a random passphrase with sufficient entropy, such that bruteforcing for a slow hash like sha512crypt becomes infeasible.
– Royce Williams
Apr 21 at 18:34
Are you sure that the hash in /etc/shadow is raw SHA-512, rather than sha512crypt ($6$) ? "Just brute force" varies - bcrypt/blowfish may be your best option (via PAM?), but sha512crypt isn't terrible, especially if you're using a random passphrase with sufficient entropy, such that bruteforcing for a slow hash like sha512crypt becomes infeasible.
– Royce Williams
Apr 21 at 18:34
add a comment
|
0
active
oldest
votes
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "89"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/4.0/"u003ecc by-sa 4.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1135807%2fpassword-hash-in-etc-shadow-weakens-the-security-if-home-encryption-is-enabled%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Ask Ubuntu!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1135807%2fpassword-hash-in-etc-shadow-weakens-the-security-if-home-encryption-is-enabled%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Are you sure that the hash in /etc/shadow is raw SHA-512, rather than sha512crypt ($6$) ? "Just brute force" varies - bcrypt/blowfish may be your best option (via PAM?), but sha512crypt isn't terrible, especially if you're using a random passphrase with sufficient entropy, such that bruteforcing for a slow hash like sha512crypt becomes infeasible.
– Royce Williams
Apr 21 at 18:34