3 ms·
There is talk of extending crypt in glibc to support external libraries [0] and that would do exactly as you suggest. [0] - https://sourceware.org/bugzilla/sho
by LinuxBender 8y ago
There is talk of extending crypt in glibc to support external libraries [0] and that would do exactly as you suggest.
[0] - https://sourceware.org/bugzilla/show_bug.cgi?id=16814 https://sourceware.org/bugzilla/show_bug.cgi?id=16814
And certainly, if you move the authentication to another service, such as I mentioned with MFA, or LDAP+Kerberos as you mentioned, that could address this, assuming that system supports scrypt / bcrypt.
- derefr 8y agoI’m still confused—why is the idea to extend crypt(3), rather than for PAM to just call something besides crypt(3), pulling in a better hashing library at the libpam level rather than at the libc level?
- LinuxBender 8y agoThat is a good question. One use case that comes to mind is sshd. The ssh daemon is not required to use pam.
- mjevans 8y agoLots of services call crypt and it expects a variable length string which describes the stored secret to compare the actual password against. It is //very// possible to update this one place and 'solve' support for MANY dependent programs and libraries. (towards the bottom of the manual page: http://man7.org/linux/man-pages/man3/crypt.3.html http://man7.org/linux/man-pages/man3/crypt.3.html )