[OT] Programmatically converting a UNIX passwd hash to an MD5hash?

[Mike Brodbelt]

David Allan Finch wrote:
> 
> Steve Langasek wrote:
> 
> > However, it's
> > easy enough to add a hook to a program so that, after verifying that the user
> > has entered the correct password, the password file is updated with the md5
> > equivalent.
> 
> Intresting. I would have thought that having to hash's two work on
> you could reduce the amount of work needed to figure out a password.

You don't retain two hashes. When the users changes password, you take
what they've entered as their existing password and crypt() it, then
compare it to the /etc/passwd entry. Assuming you get a match, you've
then authenticated the user. At this point, you request a new password,
take what's entered, hash it with MD5, and store it in /etc/passwd. You
never need to store both hashes at the same time, and the hashes are not
of the same value.

Mike.