Clear and Hash user password

[bantify]

Hello,

I was testing user pass config like below:

user infraadmin {
          password login = clear xsBf8qd1Sg5FLYL5
          member = infraadmin
        }

I can successfully login.

If I hash the password using sha256 like below:

[root@metroc-p-qv-ipa-1 ~]# echo -n "xsBf8qd1Sg5FLYL5" | sha256sum 
1fc2949e6bafcc61009af99631a700957d82364f91fc9fe2d73e24810e2e3c23  -
[root@metroc-p-qv-ipa-1 ~]# 

Then use in config like below:

        user infraadmin {
          password login = crypt $5$41fc2949e6bafcc61009af99631a700957d82364f91fc9fe2d73e24810e2e3c23
          member = infraadmin
        }

But login does not work.

Console log

[root@metroc-p-qv-ipa-3 ~]# /usr/local/sbin/tac_plus-ng -f -d 1000 /usr/local/etc/mavis/sample/tac_plus-ng-demo-pam.cfg
657979: 12:38:26.681 0/00000000: - Version d8e278390c9eee94512df0e0f0f4107300c79a65 initialized
657980: 12:38:26.681 0/00000000: - Version d8e278390c9eee94512df0e0f0f4107300c79a65 initialized
657979: 12:38:36.187 0/00000000: 10.74.0.231 connection request from 10.74.0.231 (realm: default)
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 New tacacs session
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 ---<start packet>---
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 key used: mykey
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 version: 192, type: 1, seq no: 1, flags: unencrypted
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 session id: fb1f3b09, data length: 70
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 packet body [partially masked] (len: 16):
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 0000 01 00 01 01 0a 16 0e 10  69 6e 66 72 61 61 64 6d  ........ infraadm
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 0010 69 6e 4d 2d 47 69 67 61  62 69 74 45 74 68 65 72  inM-Giga bitEther
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 0020 6e 65 74 30 2f 30 2f 30  31 39 32 2e 31 36 38 2e  net0/0/0 192.168.
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 0030 31 30 34 2e 34 36 2a 2a  2a 2a 2a 2a 2a 2a 2a 2a  104.46** ********
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 0040 2a 2a 2a 2a 2a 2a                                 ******
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 AUTHEN/START, priv_lvl=0
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 action=login (1)
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 authen_type=ascii (1)
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 service=login (1)
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 user_len=10 port_len=22 rem_addr_len=14
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 data_len=16
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 user (len: 10): infraadmin
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 port (len: 22): M-GigabitEthernet0/0/0
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 rem_addr (len: 14): 192.168.104.46
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 ---<end packet>---
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 Writing AUTHEN/GETPASS size=54
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 ---<start packet>---
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 key used: mykey
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 version: 192, type: 1, seq no: 2, flags: unencrypted
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 session id: fb1f3b09, data length: 42
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 packet body (len: 42):
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 0000 05 01 00 24 00 00 55 73  65 72 20 41 63 63 65 73  ...$..Us er Acces
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 0010 73 20 56 65 72 69 66 69  63 61 74 69 6f 6e 0a 0a  s Verifi cation..
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 0020 50 61 73 73 77 6f 72 64  3a 20                    Password : 
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 AUTHEN, status=5 (AUTHEN/GETPASS) flags=0x1
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 msg_len=36, data_len=0
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 msg (len: 36): User Access Verification\n\nPassword: 
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 data (len: 0): 
657979: 12:38:36.187 0/fb1f3b09: 10.74.0.231 ---<end packet>---
657979: 12:38:36.196 0/fb1f3b09: 10.74.0.231 ---<start packet>---
657979: 12:38:36.196 0/fb1f3b09: 10.74.0.231 key used: mykey
657979: 12:38:36.196 0/fb1f3b09: 10.74.0.231 version: 192, type: 1, seq no: 3, flags: unencrypted
657979: 12:38:36.196 0/fb1f3b09: 10.74.0.231 session id: fb1f3b09, data length: 21
657979: 12:38:36.196 0/fb1f3b09: 10.74.0.231 packet body [partially masked] (len: 16):
657979: 12:38:36.196 0/fb1f3b09: 10.74.0.231 0000 00 10 00 00 00 2a 2a 2a  2a 2a 2a 2a 2a 2a 2a 2a  .....*** ********
657979: 12:38:36.196 0/fb1f3b09: 10.74.0.231 0010 2a 2a 2a 2a 2a                                    *****
657979: 12:38:36.196 0/fb1f3b09: 10.74.0.231 AUTHEN/CONT user_msg_len=16, user_data_len=0
657979: 12:38:36.196 0/fb1f3b09: 10.74.0.231 ---<end packet>---
657979: 12:38:36.196 0/fb1f3b09: 10.74.0.231 shell login for 'infraadmin' from 192.168.104.46 on M-GigabitEthernet0/0/0 failed
657979: 12:38:37.201 0/fb1f3b09: 10.74.0.231 Writing AUTHEN/FAIL size=38
657979: 12:38:37.201 0/fb1f3b09: 10.74.0.231 ---<start packet>---
657979: 12:38:37.201 0/fb1f3b09: 10.74.0.231 key used: mykey
657979: 12:38:37.201 0/fb1f3b09: 10.74.0.231 version: 192, type: 1, seq no: 4, flags: unencrypted
657979: 12:38:37.201 0/fb1f3b09: 10.74.0.231 session id: fb1f3b09, data length: 26
657979: 12:38:37.201 0/fb1f3b09: 10.74.0.231 packet body (len: 26):
657979: 12:38:37.201 0/fb1f3b09: 10.74.0.231 0000 02 00 00 14 00 00 50 61  73 73 77 6f 72 64 20 69  ......Pa ssword i
657979: 12:38:37.201 0/fb1f3b09: 10.74.0.231 0010 6e 63 6f 72 72 65 63 74  2e 0a                    ncorrect ..
657979: 12:38:37.201 0/fb1f3b09: 10.74.0.231 AUTHEN, status=2 (AUTHEN/FAIL) flags=0x0
657979: 12:38:37.201 0/fb1f3b09: 10.74.0.231 msg_len=20, data_len=0
657979: 12:38:37.201 0/fb1f3b09: 10.74.0.231 msg (len: 20): Password incorrect.\n
657979: 12:38:37.201 0/fb1f3b09: 10.74.0.231 data (len: 0): 
657979: 12:38:37.201 0/fb1f3b09: 10.74.0.231 ---<end packet>---

Does it support hashing algorithm?

I'm following below documentation:

https://www.uni-koeln.de/~pbogusze/posts/TAC_PLUS-NG-Configuring_basic_authentication.html

[bantify]

Please ignore. it works:

user infraadmin {
          password login = crypt $51f55dddb40639daf9692a214e37286e08db3fe7152964cf34ca6199da403d010
          member = infraadmin
        }

$5 and then hash password for sha256

[MarcJHuber]

Hi,

the sha256crypt algorithm is more complex and not implemented in sha256sum, so your manually crafted hash string isn't valid.

Retry with mkpasswd -m sha256crypt (if you haven't installed that one: it's likely part of the whois package).

Cheers,

Marc

[bantify]

Thanks for the replied:

I use below method to generate password:

openssl passwd -5 -salt "$(openssl rand -base64 6)" 'xsBf8qd1Sg5FLYL5!'

Not it works.