How to set specify encryption hash when creating Linux user?

Question

I want to create a few Linux user on my computer to test JohnTheRipper against different kind of password (including length, charset and encryption hash method). How can I easily specify which hashing algorithm to use when creating a new user ? I know that the file /etc/login.defs contains the variable ENCRYPT_METHOD which is set to SHA512 by default on many Debian system but I would know if it is possible to use another encryption hash without modifying this file.

ps: I tried to modify this file, rebooting and create a new user with command adduser but the encryption hash method user is always the SHA512

thanks

Solution

The easiest method to set a up a password with a non-default hashing method is to manually hash the password first and then supply that password when setting up the user:

 adduser --password HASHEDPASSWORD user

Where the HASHEDPASSWORD must follow your system's standards for the crypt function (man 3 crypt):

If salt is a character string starting with the characters "$id$" followed by a string terminated by "$":

         $id$salt$encrypted

then instead of using the DES machine, id identifies the encryption method used and this then determines how the rest of the password string is interpreted. The following values of id are supported:

          ID  | Method
          ---------------------------------------------------------
          1   | MD5
          2a  | Blowfish (not in mainline glibc; added in some
              | Linux distributions)
          5   | SHA-256 (since glibc 2.7)
          6   | SHA-512 (since glibc 2.7)

So $5$salt$encrypted is an SHA-256 encoded password and $6$salt$encrypted is an SHA-512 encoded one.

To generate a correct hash from the commandline you can look here.

Comments

[Cyrill Gremaud]

Thank for the reference to the other post. It is helpful. But your example with add user doesn't work on my host because --password is an unknow option.

[Cyrill Gremaud]

It is working if I use mkpassword tool, and copy and past the output to /etc/shadow for the corresponding user. I will test it and edit my response