password cannot be changed ?!

DirtyAngel

Hello teamsters,

I tried to change my password simply with

sudo passwd

So I typed the new password (allowed are up to 512 chars as password) and new
password was changed "successful".
I rebooted and tried to log in with new password in gdm.
But gdm only reacts towards old password ?!

ls -al /etc/passwd
and
ls -al /etc/shadow

delivered :

-rw-r--r-- 1 root root 1741 7. Aug 19:43 /etc/passwd
-rw------- 1 root root 992 25. Aug 18:53 /etc/shadow

Is this correct ?
I think somehow it is to do with gdm ?

Harvey

sudo passwd would set a password for the root account, not your user account. You should have used sudo passwd yourusername or just passwd

DirtyAngel

Hello Harvey !! Just the command passwd worked now - after reboot I am able to use the new password. But the file sizes of /etc/passwd and /etc/shadow remain like the old sizes before ?! Though password has now doubled the size ?!

Harvey

A passwords salted hash, does not increase in length based upon the passwords length.

DirtyAngel

Hmmm, yes and where and how do I get the actual size of password or of password file ?
Or is size intentionally obscured for security ?

ReillyBrogan

DirtyAngel The size isn't "intentionally obscured", the password literally doesn't exist anywhere on the system. It's passed through a function to create a hash of it, and that hash is the only thing stored on the system. When you try to login the password you type is passed through the hash function again and then the output of that function is compared to the hash on the disk (in /etc/shadow). If the hashes match then you are logged in.

WetGeek

ReillyBrogan If the hashes match then you are logged in.

And that's why sites can't provide you with your password, if you forget it. All they can do is offer you a chance to create a new one.

ReillyBrogan

WetGeek If a site ever does send you your actual password (and not say a temporary password after resetting it) then that's a huge red flag for security

synth-ruiner

more info about cryptographic hashes if you're curious: https://en.wikipedia.org/wiki/Cryptographic_hash_function

DirtyAngel

synth-ruiner Wua !! Does this mean password is in Linux encrypted as cryptographic hash ? And when password itself is generating a cryptographic hash, then it is encrypted at least double-way ?! Then password would get "in-crackable" ?!

ReillyBrogan

DirtyAngel "encrypted" is the wrong word to use here. Encryption is two-way, with the right key you can turn encrypted data into the original data. Hashing is one way, you cannot take the hashed value and get the original data by reversing the hashing function.

sdibaja

I'm new to this version. still learning
for others that are searching and wondering===

I can confirm that running passwd does correctly reset my user password as desired
I also ran sudo passwd
to check I ran su - and confirmed my root password was also correctly reset

my best, Peter