emo/shadow
1
0
Fork 0
Code Issues Pull Requests Packages Releases Activity

login.defs: warn about weak choices

Browse Source 
According to crypt(5), MD5 and DES should not be used for new
hashes. Also the default number of SHA rounds chosen by libc is orders
of magnitude too low for modern hardware. Let's warn the users about
weak choices.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
This commit is contained in:
Topi Miettinen
2020-04-10 14:09:55 +03:00
parent 125a5dc309
commit 69301dfa24
3 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
man/login.defs.d/ENCRYPT_METHOD.xml
View File

@@ -39,6 +39,9 @@
<replaceable>MD5</replaceable><phrase condition="sha_crypt">,
<replaceable>SHA256</replaceable>,
<replaceable>SHA512</replaceable></phrase>.
MD5 and DES should not be used for new hashes, see
<refentrytitle>crypt</refentrytitle><manvolnum>5</manvolnum>
for recommendations.
</para>
<para>
Note: this parameter overrides the <option>MD5_CRYPT_ENAB</option>

2
man/login.defs.d/SHA_CRYPT_MIN_ROUNDS.xml
View File

@@ -44,7 +44,7 @@
</para>
<para>
If not specified, the libc will choose the default number of rounds
(5000).
(5000), which is orders of magnitude too low for modern hardware.
</para>
<para>
The values must be inside the 1000-999,999,999 range.