Loading

×Sorry to interrupt
CSS Error

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Changing the default password hashing algorithm from md5 to sha512 in ESXi / ESX 4.x (1032666)

Last Updated: 3/20/2024Categories: Total Views: 19670Language:
English

3 like this article

Subscribe to get an email
newsletter with new updates

3 people found this helpful Please provide article feedback:

Purpose

This article provides information on changing the default password hashing algorithm from md5 to sha512 on ESX 4.x hosts.

Resolution

Setting the ESXi host to use SHA512 encryption algorithm

Log in to the ESXi host using the Local Tech Support Mode or SSH.

Note: Ensure that the appropriate support mode is enabled in Direct Console > Customize System (F2) > Troubleshooting Options.

Back up the /etc/shadow and /etc/pam.d/system-auth files.

Run these commands to assign edit permission to the system-auth file.

#cd /etc/pam.d
#chmod 644 system-auth

Open the system-auth file using a text editor.

Search for the password sufficient entry in the file, similar to:

password sufficient /lib/security/$ISA/pam_unix.so use_authtok nullok shadow

Replace the existing hash key ( md5, des, or sha256) with sha512 or append sha512, if there is no existing key. For example:

password sufficient /lib/security/$ISA/pam_unix.so use_authtok nullok shadow sha512

Run this command to restore the system-auth file permissions:

#chmod 444 pam.d/system-auth

If you want all passwords to be in the new hash format, you must renew the passwords for all users.

For example, to change the hash format for the root password and to verify if the encryption algorithm is updated:

Run this command to change the root password:

#passwd root

Open the /etc/shadow file and verify the if the encryption algorithm is updated.

To verify the encryption algorithm, run this command:

#cat /etc/shadow

You see an output similar to:

root:$6$BpPe7UrJ$oLexOiRNefHHDsfVETKTL0:13358:0:99999:7:::

The tag $6$ in the output indicates that a sha512 encryption algorithm is used.

Note: In ESXi, changes made to the /etc/pam.d/system-auth file to edit password settings do not persist across system reboots.

This issue is fixed in ESXi 5.0.

Setting the ESX host to use SHA512 encryption algorithm

Log in to the ESX host using the console or SSH.

Back up these files:

/etc/pam.d/system-auth-*

/etc/libuser.conf

/etc/login.defs

/etc/shadow

Run these commands to assign edit permissions to the system-auth , libuser.conf , and login.defs files:

#cd /etc
#chmod 644 pam.d/system-auth-*
#chmod 644 libuser.conf
#chmod 644 login.defs

Open the /etc/pam.d/system-auth-generic file using a text editor.

Search for the password sufficient entry in the file, similar to:

password sufficient /lib/security/$ISA/pam_unix.so use_authtok nullok shadow

Replace the existing hash key ( md5, des, or sha256) with sha512 or append sha512, if there is no existing key. For example:

password sufficient /lib/security/$ISA/pam_unix.so use_authtok nullok shadow sha512

Open the /etc/pam.d/system-auth-local file using a text editor.

Repeat Steps 5 and 6 for the /etc/pam.d/system-auth-local file.

Open the /etc/libuser.conf file using a text editor.

Change this entry:

crypt_style = md5

to

crypt_style = sha512

Open the /etc/login.defs file using a text editor.

Change this entry:

MD5_CRYPT_ENAB yes

to

MD5_CRYPT_ENAB no

Change this entry:

ENCRYPT_METHOD DES

to

ENCRYPT_METHOD SHA512

Note: If the MD5_CRYPT_ENAB and ENCRYPT_METHOD entries are not available in the /etc/login.defs file, add them at the end of the file:

MD5_CRYPT_ENAB no
ENCRYPT_METHOD SHA512

Run these commands to restore the permissions on the system-auth , libuser.conf , and login.defs files:

#chmod 444 pam.d/system-auth-*
#chmod 444 libuser.conf
#chmod 444 login.defs

If you want all passwords to be in the new hash format, you must renew the passwords for all users.

For example, to change the hash format for the root password and to verify if the encryption algorithm is updated:

Run this command to change the root password:

#passwd root

Open the /etc/shadow file and verify the if the encryption algorithm is updated.

To verify the encryption algorithm, run this command:

#cat /etc/shadow

You see an output similar to:

root:$6$zR1rwYqO$aP/hDfnYQQ1oJVigYbG3O0:14833:0::7:::

The tag $6$ in the output indicates that a sha512 encryption algorithm is used.

Note: Changing the hash method does not rehash existing passwords. It only impacts the format in which future passwords are stored when new accounts are created and passwords of existing accounts are modified.

Related Information

There are two other weaker password hash methods: DES and SHA256. To use these hash methods, you must update the hash methods to des or sha256 in the appropriate files. Ensure to use DES and SHA256 (upper case) in the login.defs file.

Note: VMware does not recommend using these weaker password has methods.

The following table lists the various encryption methods and their tags as seen in the /etc/shadow file:

Encryption Method

Tag as seen in the /etc/shadow file

DES

13-char

MD5

$1$

SHA256

$5$

SHA512

$6$

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
English

Attachments

Additional Resources

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

KB
•
Download and Install VMware Fusion (2014097)

Results 1-2 of 2

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware vSphere ESXi

VMware ESX Server

Related Versions:

VMware ESXi 4.1.x Installable

VMware ESXi 4.1.x Embedded

VMware ESXi 4.0.x Installable

VMware ESXi 4.0.x Embedded

VMware ESX 4.1.x

VMware ESX 4.0.x

Take Our Survey

Support Assistant