Hey all,

I'm looking to find out exactly how to go about changing the encryption method of shadow passwords from MD5 to something a bit stronger, like SHA. I've been looking around for a bit now and haven't found out how to do it.

I've gathered that I'll most likely need to change the /etc/pam.d/system-auth file. Right now, there is a line that looks like this:

password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok

I'm guessing the md5 should be changed to something else, like sha256.

What else? I know I'll need to reset all passwords once the change is made, but I thought there was someplace else that controls how the passwd command encrypts passwords.

Any suggestions please?

Thanks!

Hi,

what you're looking for is 'system-config-authentication' -> Options tab -> Password hashing algorithm option

This utility affects the /etc/login.defs file, so, I believe, you can also achieve this by directly editing the file. But personally, I'd stick to the 'system-config-authentication' utility.


Regards,