PR#17: Change the default password hash method to yescrypt - rpms/pam

rpms / pam

#17 Change the default password hash method to yescrypt

Merged 2 years ago by besser82. Opened 3 years ago by besser82.

rpms/ besser82/pam topic/besser82/yescrypt into main

Change the default password hash method to yescrypt

Björn Esser • 2 years ago

9ba9b6c

pam.spec

file modified

+4 -1

		`@@ -3,7 +3,7 @@`
		`Summary: An extensible library which provides authentication for applications`
		`Name: pam`
		`Version: 1.5.1`
		`- Release: 6%{?dist}`
		`+ Release: 7%{?dist}`
		`# The library is BSD licensed with option to relicense as GPLv2+`
		`# - this option is redundant as the BSD license allows that anyway.`
		`# pam_timestamp, pam_loginuid, and pam_console modules are GPLv2+.`
		`@@ -381,6 +381,9 @@`
		`exit 0`

		`%changelog`
		`+ * Thu Jun 10 2021 Björn Esser <besser82@fedoraproject.org> - 1.5.1-7`
		`+ - Change the default password hash method to yescrypt`
		`+`
		`* Thu Jun 10 2021 Björn Esser <besser82@fedoraproject.org> - 1.5.1-6`
		`- Add a patch to not use crypt_checksalt for password expiration`
		`Resolves: #1965345, #1967150`

password-auth.pamd

file modified

+1 -1

		`@@ -6,7 +6,7 @@`
		`account required pam_unix.so`

		`password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=`
		`- password sufficient pam_unix.so try_first_pass use_authtok nullok sha512 shadow`
		`+ password sufficient pam_unix.so try_first_pass use_authtok nullok yescrypt shadow`
		`password required pam_deny.so`

		`session optional pam_keyinit.so revoke`

system-auth.pamd

file modified

+1 -1

		`@@ -6,7 +6,7 @@`
		`account required pam_unix.so`

		`password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=`
		`- password sufficient pam_unix.so try_first_pass use_authtok nullok sha512 shadow`
		`+ password sufficient pam_unix.so try_first_pass use_authtok nullok yescrypt shadow`
		`password required pam_deny.so`

		`session optional pam_keyinit.so revoke`

besser82 commented 3 years ago

The yescrypt hashing method is considered to be much stronger than sha512crypt and fully supported by libxcrypt. It is based on NIST-approved primitives and on par with argon2 in strength.

Fresh installed systems, as well as newly computed hashes for the UNIX shadow file should prefer this method.

See also:

Metadata Update from @besser82:
- Request assigned

3 years ago