Skip to content

Commit 152e56b

Browse files
alejandro-colomaralejandro-colomar
committed
*/: Remove support for MD5
Signed-off-by: Alejandro Colomar <alx@kernel.org>
1 parent 868883e commit 152e56b

File tree

146 files changed

+33
-2185
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

146 files changed

+33
-2185
lines changed

‎etc/login.defs‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -295,12 +295,10 @@ CHFN_RESTRICT rwh
295295

296296
#
297297
# Only works if compiled with ENCRYPTMETHOD_SELECT defined:
298-
# If set to MD5, MD5-based algorithm will be used for encrypting password
299298
# If set to SHA256, SHA256-based algorithm will be used for encrypting password
300299
# If set to SHA512, SHA512-based algorithm will be used for encrypting password
301300
# If set to BCRYPT, BCRYPT-based algorithm will be used for encrypting password
302301
# If set to YESCRYPT, YESCRYPT-based algorithm will be used for encrypting password
303-
# MD5 should not be used for new hashes, see crypt(5) for recommendations.
304302
#
305303
# Note: if you use PAM, it is recommended to use a value consistent with
306304
# the PAM modules configuration.

‎lib/chkhash.c‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -57,10 +57,6 @@ is_valid_hash(const char *hash)
5757
if (match_regex("^\\$5\\$(rounds=[1-9][0-9]{3,8}\\$)?[^$:\\n]{1,16}\\$[./A-Za-z0-9]{43}$", hash))
5858
return true;
5959

60-
// MD5: $1$ + salt + $ + 22-char hash
61-
if (match_regex("^\\$1\\$[^$:\\n]{1,8}\\$[./A-Za-z0-9]{22}$", hash))
62-
return true;
63-
6460
// Not a valid hash
6561
return false;
6662
}

‎lib/obscure.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ static bool similar (/*@notnull@*/const char *old, /*@notnull@*/const char *new)
5656

5757
/*
5858
* XXX - sometimes this fails when changing from a simple password
59-
* to a really long one (MD5). For now, I just return success if
59+
* to a really long one. For now, I just return success if
6060
* the new password is long enough. Please feel free to suggest
6161
* something better... --marekm
6262
*/

‎lib/salt.c‎

Lines changed: 5 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -77,9 +77,6 @@
7777
#define Y_COST_MAX 11
7878
#endif
7979

80-
/* Fixed salt len for md5crypt. */
81-
#define MD5_CRYPT_SALT_SIZE 8
82-
8380
/* Generate salt of size salt_size. */
8481
#define MAX_SALT_SIZE 44
8582
#define MIN_SALT_SIZE 8
@@ -357,10 +354,11 @@ static /*@observer@*/const char *gensalt (size_t salt_size)
357354

358355
method = meth ?: getdef_str("ENCRYPT_METHOD") ?: "SHA512";
359356

360-
if (streq(method, "MD5")) {
361-
MAGNUM(result, '1');
362-
salt_len = MD5_CRYPT_SALT_SIZE;
363-
rounds = 0;
357+
if (streq(method, "SHA256")) {
358+
MAGNUM(result, '5');
359+
salt_len = SHA_CRYPT_SALT_SIZE;
360+
rounds = SHA_get_salt_rounds (arg);
361+
SHA_salt_rounds_to_buf (result, rounds);
364362
#ifdef USE_BCRYPT
365363
} else if (streq(method, "BCRYPT")) {
366364
BCRYPTMAGNUM(result);
@@ -375,11 +373,6 @@ static /*@observer@*/const char *gensalt (size_t salt_size)
375373
rounds = YESCRYPT_get_salt_cost (arg);
376374
YESCRYPT_salt_cost_to_buf (result, rounds);
377375
#endif /* USE_YESCRYPT */
378-
} else if (streq(method, "SHA256")) {
379-
MAGNUM(result, '5');
380-
salt_len = SHA_CRYPT_SALT_SIZE;
381-
rounds = SHA_get_salt_rounds (arg);
382-
SHA_salt_rounds_to_buf (result, rounds);
383376
} else if (streq(method, "SHA512")) {
384377
sha512:
385378
MAGNUM(result, '6');

‎man/chgpasswd.8.xml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,6 @@
9292
<para>
9393
The available methods are <phrase condition="bcrypt">
9494
<replaceable>BCRYPT</replaceable>,</phrase>
95-
<replaceable>MD5</replaceable>,
9695
<replaceable>SHA256</replaceable>,
9796
<replaceable>SHA512</replaceable>,
9897
<phrase condition="yescrypt">

‎man/chpasswd.8.xml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -118,7 +118,6 @@
118118
<para>
119119
The available methods are <phrase condition="bcrypt">
120120
<replaceable>BCRYPT</replaceable>,</phrase>
121-
<replaceable>MD5</replaceable>,
122121
<replaceable>SHA256</replaceable>,
123122
<replaceable>SHA512</replaceable>,
124123
<phrase condition="yescrypt">

‎man/login.defs.d/ENCRYPT_METHOD.xml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,11 @@
1212
<para>
1313
It can take one of these values: <phrase condition="bcrypt">
1414
<replaceable>BCRYPT</replaceable>,</phrase>
15-
<replaceable>MD5</replaceable>,
1615
<replaceable>SHA256</replaceable>,
1716
<replaceable>SHA512</replaceable>,
1817
<phrase condition="yescrypt">
1918
<replaceable>YESCRYPT</replaceable></phrase>.
20-
MD5 should not be used for new hashes, see
19+
See
2120
<refentrytitle>crypt</refentrytitle><manvolnum>5</manvolnum>
2221
for recommendations.
2322
</para>

‎man/newusers.8.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -271,7 +271,7 @@
271271
<listitem>
272272
<para>Use the specified method to encrypt the passwords.</para>
273273
<para>
274-
The available methods are MD5, NONE, and SHA256 or SHA512
274+
The available methods are NONE, and SHA256 or SHA512
275275
if your libc support these methods.
276276
</para>
277277
</listitem>

‎src/chgpasswd.c‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -120,8 +120,7 @@ usage (int status)
120120
Prog);
121121
(void) fprintf (usageout,
122122
_(" -c, --crypt-method METHOD the crypt method (one of %s)\n"),
123-
"NONE MD5"
124-
" SHA256 SHA512"
123+
"NONE SHA256 SHA512"
125124
#if defined(USE_BCRYPT)
126125
" BCRYPT"
127126
#endif
@@ -237,8 +236,7 @@ static void check_flags (void)
237236
}
238237

239238
if (cflg) {
240-
if ( !streq(crypt_method, "MD5")
241-
&& !streq(crypt_method, "NONE")
239+
if ( !streq(crypt_method, "NONE")
242240
&& !streq(crypt_method, "SHA256")
243241
&& !streq(crypt_method, "SHA512")
244242
#ifdef USE_BCRYPT

‎src/chpasswd.c‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -117,8 +117,7 @@ usage (int status)
117117
Prog);
118118
(void) fprintf (usageout,
119119
_(" -c, --crypt-method METHOD the crypt method (one of %s)\n"),
120-
"NONE MD5"
121-
" SHA256 SHA512"
120+
"NONE SHA256 SHA512"
122121
#if defined(USE_BCRYPT)
123122
" BCRYPT"
124123
#endif
@@ -233,8 +232,7 @@ static void check_flags (void)
233232
}
234233

235234
if (cflg) {
236-
if (!IS_CRYPT_METHOD("MD5")
237-
&&(!IS_CRYPT_METHOD("NONE"))
235+
if (!IS_CRYPT_METHOD("NONE")
238236
&&(!IS_CRYPT_METHOD("SHA256"))
239237
&&(!IS_CRYPT_METHOD("SHA512"))
240238
#ifdef USE_BCRYPT

0 commit comments

Comments
 (0)