I had a question the other day asking whether the encrypted password which can be specified within an ESXi Kickstart file (denoted by the --isencrypted flag) can use a different hashing algorithm other than MD5? The answer is absolutely yes. In fact, MD5 as a default hashing algorithm has NOT been used for a number of releases, probably dating back to classic ESX (you know, the version that had the Service Console).
For all recent releases of ESXi including 5.5 to 6.7, the default hashing algorithm has been SHA512 for quite some time now. Below are two ways in which you can check which default hashing algorithm is currently being used:
Option 1 - SSH to ESXi host and take a look at /etc/pam.d/passwd
Option 2 - SSH to ESXi host and take a look at /etc/shadow and look at the field prior to the salt.
As a reference:
- $1$ - MD5
- $5$ - SHA256
- $6$ - SHA512
krishnaprasad says
01/21/2019 at 4:31 amHello, On a 6.7 U1 host, openssl shows the below error while trying to generated a crypted password. Any tips to overcome this?
:~] openssl passwd -1
Password:
Verifying – Password:
fips_md.c(146): OpenSSL internal error, assertion failed: Digest update previous FIPS forbidden algorithm error ignored
Aborted
elnemesisdivina says
02/18/2019 at 6:35 pmIn the example you have the password hashed with sha-512 but also salted how do you handle to create the first time password? I mean you use the same word to produce the same hash always or what is the default word for salt password plus hash to generate same result? in my mind is more secure to generate salt plus hash but at the end will be not the same result and consequently this will be store and then when compare will be wrong correct?
thxs