Bash – Using hashed password for adduser function in Linux

bashhashsumlinuxshadowuseradd

Sorry, I´m novice in Linux and I am looking for information, how to create new user account in Debian with pre-defined encrypted password.

I have a function in bash, that if new user´s id´s are not presented in my /etc/passwd file than I run the bash command:

adduser -m -p <encrypted-password> <username>

so far so good, but all my data including username and password are stored in JSON output and user´s password is already hashed by SHA-512 (for security reasons). User´s password is encrypted by PHP script and sent to JSON:

$hashed_password = crypt('Test007', '$6$rounds=5000$StJ.1Wji$');
echo looks like this: $6$rounds=5000$StJ.1Wji$cm6ZVl.XoIiQXaJAVHkqiteUGAqZoJ1Ee3dpHP2a6x6rG/kHg4k7ucMLrzHCvQA1TpQYP4eKnoFITVGcviqjU0

After adduser function when I look in my /etc/shadow file, I see that the hashed password is different from original one generated by PHP and of course I cannot login the new user with that password in plain text (even if I know it in plain text).

Is there an easy way, how to create user account with pre-defined encrypted password? How to generated hashed password to be accepted by Linux useradd function? I cannot find any solutions on the internet.

Best Answer

That $6$rounds=5000 is probably part of the problem, because except for the leading $6, the entire value passed to adduser has to be a valid hash. Also (not apparent in your script fragment), the value should be quoted to avoid parameter expansion, e.g.,

adduser -m -p '$6$gehr8sgkkX$lMZ5bmb7c4HY76pnn0uUXA5wH51YE0Byp4rIfcA94gWrVvfeNVQsMwoW2erVuxzFScxRvaHOLFMqVSYCjVlTV/' oneshot

I used mkpasswd to get a value as suggested in How to create an SHA-512 hashed password for shadow?

In a quick check here, the value stored in /etc/shadow matches the value I used when running adduser.

Method 1 (md5, sha256, sha512)

openssl passwd -6 -salt xyz  yourpass

Note: passing -1 will generate an MD5 password, -5 a SHA256 and -6 SHA512 (recommended)

Method 2 (md5, sha256, sha512)

mkpasswd --method=SHA-512 --stdin

The option --method accepts md5, sha-256 and sha-512

Method 3 (des, md5, sha256, sha512)

As @tink suggested, we can update the password using chpasswd using:

echo "username:password" | chpasswd

Or you can use the encrypted password with chpasswd. First generate it using this:

perl -e 'print crypt("YourPasswd", "salt", "sha512"),"\n"'

Then later you can use the generated password to update /etc/shadow:

echo "username:encryptedPassWd" | chpasswd -e

The encrypted password we can also use to create a new user with this password, for example:

useradd -p 'encryptedPassWd'  username

Users – Steps to Add a User Without Using useradd/adduser

The possible way to add an user is more or less similar to what I had put in the question. I got this approach from here.

To create a new account manually, follow these steps:

Edit /etc/passwd with vipw and add a new line for the new account. Be careful with the syntax. Do not edit directly with an editor. vipw locks the file, so that other commands won't try to update it at the same time. You should make the password field be `*', so that it is impossible to log in.

Similarly, edit /etc/group with vigr, if you need to create a new group as well.

Create the home directory of the user with mkdir.

Copy the files from /etc/skel to the new home directory.

Fix ownerships and permissions with chown and chmod. The -R option is most useful. The correct permissions vary a little from one site to another, but usually the following commands do the right thing:

cd /home/newusername
chown -R username.group .
chmod -R go=u,go-w .
chmod go= .

Set the password with passwd.

After you set the password in the last step, the account will work. You shouldn't set it until everything else has been done, otherwise the user may inadvertently log in while you're still copying the files.

Best Answer

Related Solutions

Linux – How to Manually Generate Password for /etc/shadow

Method 1 (md5, sha256, sha512)

Method 2 (md5, sha256, sha512)

Method 3 (des, md5, sha256, sha512)

Users – Steps to Add a User Without Using useradd/adduser

Related Question