|
We know that users' passwords are saved in As shown above, Is there a way (possible configuration) to save the password in the |
|||||||||||||||||||||
|
|
Oh dear, okay, let's start at the very beginning...
No, they have been stored in
I know it's sometimes used interchangeably, but hashing is not encryption. Encryption is by its very definition reversible, meaning you can translate the encrypted thing back into its cleartext form. Hashing is designed to be not reversible in any way (except brute force). The original cleartext form of something that is hashed is not supposed to be recoverable. Passwords in the shadow file are stored as hashes.
The
No, there isn't a way except changing many applications and the way they work. But why is it not easily possible? Well, for a simple but very important reason: security. I suggest to read these questions:
But to sum it up, assume the following: There is a server in a company, all user accounts are secured by their passwords and the data in these user accounts is encrypted with the same password. A cracker from the outside gains access to the server, but they can't access any of the important data because that is still encrypted in the user accounts. Now assume the passwords would be stored in plain text. The cracker would suddenly have access to everything, because the passwords can be read. But if they're stored as hashed values, they are close to useless to anyone except people with a lot of resources to do a brute-force attack. |
|||||||||||||||||||||
|
|
The other two answers have told you—correctly!—that this is a Bad Idea™. But they've also told you its hard to do, requiring changing a bunch of programs. That's not true. It's very easy. You only need to change one or two configuration files. I feel its important to point this out, because you should be aware of it when logging into systems you don't control. These won't actually put a plain-text password in
For further details, check the PAM System Admin Guide. You could also edit the source code of PAM, or write your own module. You'd only need to compile PAM (or your module), nothing else. |
|||||||||||||||||
|
|
First of all the encrypted passwords are not in To just store the passwords in plain text, is not necessary and would require updates to the password program and libraries reading the If this would be an option in the configuration of a setup, then there would always be stupid people that would switch it on inappropriately. And while they are still working on CRT screens and broadcast this in a way that it can be easily picked up from outside their building, while they are looking at the information. Aside from that, people tend to use the same or similar password on multiple systems, so that is not a good idea for any passwords to be human readable. As some sysadmin could retry theirs on other systems (s)he knows the user has an account. There must be more interesting things, the workings of can be investigated on your system. |
|||||||||
|
|
The basic reason is that no user (root, admin or other) should ever have access to another's user password. Simply because the password is a means of authentication. If I know some other user's password, I know their credentials (username + password), so I can login as that user, impersonating him (or her or it.) Any action I do when logged in as that user, the other user will be held responsible for. And that is not how authentication should work. The actions can be disastrous, like deleting a whole bunch of important files, erasing hard disks, erasing backups, shutting down nuclear power plans, etc. Or just illegal. Imagine a bank institution where I (the admin) have access to all passwords. Using the cashier's password I can order a move of a million dollars from the president's bank account to the window cleaner's bank account. Then use the cashier's superior password to approve the transaction. Then approve a check from the window cleaner's account to my own off-shore bank account. Then I go for long vacation in the Bahamas ... |
|||
|
|
|
No,
The basic idea to make the handling of passwords save is to store them not at all - that means, of course, nobody can see them, root or not root. |
|||||||||||||
|
