Logging into sudo with a hashed password

Question

I am curious as to whether or not I can pass the sudo password prompt the hashed sha512(?) password and log in to root that way. So it might look something like this:

[user@device ~]$ sudo su -
[sudo] password for user: 'some hashed password from shadow file' 

Is this possible? If so, is there an easy way to get this hashed password?

Solution

That would defeat the purpose of storing the hashed password.

I'm sure you know, but just in case the idea behind hashing is pretty simple -- you find a function which is easy to calculate in one direction but incredibly difficult to calculate in the other direction. Let's call that function hash.

Now, when you first create your password, say hunter2 the system will run hash('hunter2') and store the result in the shadow file.

Then when you log into the system you claim that your password is hunter4 and the system checks this by comparing hash('hunter4') to the value stored in the shadow file. If the hashes are equal system will let you log on, if they're not then the system will deny you.

The advantage to this is that even if someone manages to get access to your shadow file, they still don't know your password and can't log on as you because although they know the hash, it's incredibly difficult to determine the password that produced this hash.

In short, no the hash stored in /etc/shadow is not and can not be used as a substitute for a users password.

Comments

[user3119546]

thanks, basically I want to call a file with sudo but I dont want to be echoing a plaintext password over the network. Suggestions?

[ztk]

Use ssh (or any other encrypted protocol) for the network connection, that will prevent anyone from reading it in transit.

[user3119546]

This makes complete sense, and it is what I expected. I am simply trying to call a command with sudo without having to 'echo' the password on the network. Thoughts on how I could go about doing this in a more secure fashion? I thought that maybe I could pass the hash as the 'password' and then they could compare the result of me running 'hash('hunter2')' to the stored has in the shadow file. But I understand why they want to eliminate that option if someone unauthorized gains access to the shadow file.