3 ms·
> If they have root on your VM, they have your root password too. We're talking about maybe a couple hundred lines of code, tops. The default hash for crypt(3)
by swolchok 17y ago
> If they have root on your VM, they have your root password too. We're talking about maybe a couple hundred lines of code, tops.
The default hash for crypt(3) (and thus /etc/shadow) in newer Linux distributions is salted SHA-512. Shouldn't that be significantly more difficult to crack than the old MD5 hashes? john didn't even support it when I checked a few months ago.
- devicenull 17y agoYou don't have to crack it if you can just replace the login binary with one that logs it somewhere.
- swolchok 17y agoOh, of course. I errantly assumed they didn't have root at the same time as you still had access.
- peterwwillis 17y agoIn effect, No. The computing power required to crack SHA-512 is infinitesimal compared to that for, say, bcrypt. However, modern crypt() implementations support multiple rounds just like bcrypt and that would make it significantly more difficult (time-wise) to crack. But then again SHA-512 is already being replaced due to some potential flaws found, so.... shrug Kind of pointless to crack your password, though. I mean, it's not like you use the same one for more than one account.
- rapind 17y agoNo of course not. I'm sure we all use a different password for every box, webapp account, registrar, email address etc. I myself keep 100 or so passwords in my head, just like everyone else...
- peterwwillis 17y agoi know right? after the 16th character in the 96-character set it gets a little tiresome to type but i think keeping my twitter account secure is worth it.
- maurycy 17y agoTo be honest, I even don't know my remote passwords. They're completely random. I just use SSH keys. 1Password and encrypted text files serve well as a backup.
- rapind 17y agoI agree with that completely. I use dsa for my boxes, but still there's so many other services I use where it isn't an option.