Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1899716

Summary: password hash created using python crypt works in RHEL 6 and 7 but fails in RHEL 8
Product: Red Hat Enterprise Linux 8 Reporter: Eugene Keck <ekeck>
Component: libxcryptAssignee: Stanislav Zidek <szidek>
Status: CLOSED ERRATA QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: medium Docs Contact:
Priority: medium    
Version: 8.4CC: ansasaki, ashankar, asosedki, besser82, codonell, dj, fweimer, jjelen, mnewsome, ole.h.nielsen, pfrankli, sipoyare, ssorce
Target Milestone: rcKeywords: Triaged
Target Release: 8.0Flags: pm-rhel: mirror+
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: libxcrypt-4.1.1-5.el8 Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-11-09 19:32:37 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Eugene Keck 2020-11-19 20:15:34 UTC
Description of problem:
When creating a password hash using python crypt works in RHEL 6 and 7 but fails in RHEL 8

Version-Release number of selected component (if applicable):
glibc-2.28-101.el8.x86_64

How reproducible:
Always 

Steps to Reproduce:
1. See Additional info

Actual results:
Failed login on RHEL 8

Expected results:
Successful login on RHEL 8

Additional info:

On Red Hat 6 create the password hash

[root@rhel6 ~]# cat passwd.sh
password=redhat
SALT=`date +%s | base64`"\$"
HASH512=`python -c "import crypt; print crypt.crypt('${password}','\\$6\\$$SALT')"`
echo Hash: $HASH512

[root@rhel6 ~]# ./passwd.sh
Hash: $6$MTYwNTgxMzc4Nwo=$AzrYpEqcRH2Iypn.DNj3YOzjiBkBFtp.X5enC4bOsUI0f93ufGVhU.rFUFwSf7dQf4FjpdJ1mveVs/6nhbmgW/

[root@rhel6 ~]# adduser testuser

[root@rhel6 ~]# echo 'testuser:$6$MTYwNTgxMzc4Nwo=$AzrYpEqcRH2Iypn.DNj3YOzjiBkBFtp.X5enC4bOsUI0f93ufGVhU.rFUFwSf7dQf4FjpdJ1mveVs/6nhbmgW/' | chpasswd -e

[root@rhel6 ~]# grep testuser /etc/shadow
testuser:$6$MTYwNTgxMzc4Nwo=$AzrYpEqcRH2Iypn.DNj3YOzjiBkBFtp.X5enC4bOsUI0f93ufGVhU.rFUFwSf7dQf4FjpdJ1mveVs/6nhbmgW/:18585:0:99999:7:::

[root@rhel6 ~]# ssh testuser.0.1
The authenticity of host '127.0.0.1 (127.0.0.1)' can't be established.
RSA key fingerprint is e8:87:08:2b:26:6f:94:49:64:4f:aa:26:74:f4:01:57.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '127.0.0.1' (RSA) to the list of known hosts.
testuser.0.1's password:
[testuser@rhel6 ~]$

-------------------------------------------------------------------------------------------------------------

Test on RHEL 7

[root@rhel7 ~]# adduser testuser

[root@rhel7 ~]# echo 'testuser:$6$MTYwNTgxMzc4Nwo=$AzrYpEqcRH2Iypn.DNj3YOzjiBkBFtp.X5enC4bOsUI0f93ufGVhU.rFUFwSf7dQf4FjpdJ1mveVs/6nhbmgW/' | chpasswd -e

[root@rhel7 ~]# grep testuser /etc/shadow
testuser:$6$MTYwNTgxMzc4Nwo=$AzrYpEqcRH2Iypn.DNj3YOzjiBkBFtp.X5enC4bOsUI0f93ufGVhU.rFUFwSf7dQf4FjpdJ1mveVs/6nhbmgW/:18585:0:99999:7:::


[root@rhel7 ~]# ssh testuser.0.1
The authenticity of host '127.0.0.1 (<no hostip for proxy command>)' can't be established.
ECDSA key fingerprint is SHA256:g1UrtI+ArH2KqXgql056E5TAXqAcD5PSMVbbFJLeNi0.
ECDSA key fingerprint is MD5:82:b4:dc:c4:44:5a:cf:1c:4b:59:de:ce:3e:23:be:5c.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts.
Password:
[testuser@rhel7 ~]$

-------------------------------------------------------------------------------------------------------------

Then test on RHEL 8 which fails

[root@rhel8 ~]# adduser testuser

[root@rhel8 ~]# echo 'testuser:$6$MTYwNTgxMzc4Nwo=$AzrYpEqcRH2Iypn.DNj3YOzjiBkBFtp.X5enC4bOsUI0f93ufGVhU.rFUFwSf7dQf4FjpdJ1mveVs/6nhbmgW/' | chpasswd -e

[root@rhel8 ~]# grep testuser /etc/shadow
testuser:$6$MTYwNTgxMzc4Nwo=$AzrYpEqcRH2Iypn.DNj3YOzjiBkBFtp.X5enC4bOsUI0f93ufGVhU.rFUFwSf7dQf4FjpdJ1mveVs/6nhbmgW/:18585:0:99999:7:::

[root@rhel8 ~]# ssh testuser.0.1
The authenticity of host '127.0.0.1 (<no hostip for proxy command>)' can't be established.
ECDSA key fingerprint is SHA256:p3lgOPmFQmvQHIQLS+9S63WnbeeBGgsy/FKjGJzLyBg.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts.
Password:
Password:
Password:
testuser.0.1's password:
Permission denied, please try again.
testuser.0.1's password:
Permission denied, please try again.
testuser.0.1's password:
Received disconnect from UNKNOWN port 65535:2: Too many authentication failures
Disconnected from UNKNOWN port 65535

Nov 19 14:55:41 swzc1pridm21 sshd[33407]: error: PAM: Authentication failure for testuser from 127.0.0.1
Nov 19 14:55:43 swzc1pridm21 unix_chkpwd[33425]: password check failed for user (testuser)
Nov 19 14:55:43 swzc1pridm21 sshd[33423]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.0.0.1  user=testuser
Nov 19 14:55:45 swzc1pridm21 sshd[33407]: error: PAM: Authentication failure for testuser from 127.0.0.1
Nov 19 14:55:47 swzc1pridm21 unix_chkpwd[33427]: password check failed for user (testuser)
Nov 19 14:55:47 swzc1pridm21 sshd[33426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.0.0.1  user=testuser
Nov 19 14:55:49 swzc1pridm21 sshd[33407]: error: PAM: Authentication failure for testuser from 127.0.0.1
Nov 19 14:55:52 swzc1pridm21 unix_chkpwd[33428]: password check failed for user (testuser)
Nov 19 14:55:52 swzc1pridm21 sshd[33407]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.0.0.1  user=testuser
Nov 19 14:55:54 swzc1pridm21 sshd[33407]: Failed password for testuser from 127.0.0.1 port 38008 ssh2
Nov 19 14:56:00 swzc1pridm21 unix_chkpwd[33429]: password check failed for user (testuser)
Nov 19 14:56:01 swzc1pridm21 sshd[33407]: Failed password for testuser from 127.0.0.1 port 38008 ssh2
Nov 19 14:56:05 swzc1pridm21 unix_chkpwd[33430]: password check failed for user (testuser)
Nov 19 14:56:07 swzc1pridm21 sshd[33407]: Failed password for testuser from 127.0.0.1 port 38008 ssh2
Nov 19 14:56:08 swzc1pridm21 sshd[33407]: error: maximum authentication attempts exceeded for testuser from 127.0.0.1 port 38008 ssh2 [preauth]
Nov 19 14:56:08 swzc1pridm21 sshd[33407]: Disconnecting authenticating user testuser 127.0.0.1 port 38008: Too many authentication failures [preauth]
Nov 19 14:56:08 swzc1pridm21 sshd[33407]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.0.0.1  user=testuser

-------------------------------------------------------------------------------------------------------------

If I set the password to the same password it does work

[root@rhel8 ~]# passwd testuser
Changing password for user testuser.
New password:
BAD PASSWORD: The password is shorter than 8 characters
Retype new password:
passwd: all authentication tokens updated successfully.

[root@rhel8 ~]# ssh testuser.0.1
Password:
Last failed login: Thu Nov 19 15:01:11 EST 2020 from 127.0.0.1 on ssh:notty
There were 11 failed login attempts since the last successful login.
[testuser@rhel8 ~]$

Comment 1 Florian Weimer 2020-11-20 10:31:48 UTC
libcrypt comes from the libxcrypt package in Red Hat Enterprise Linux 8, reassigning.

I believe there is an upstream fix for this: https://github.com/besser82/libxcrypt/pull/106

Comment 2 Tomas Mraz 2020-11-24 16:11:33 UTC
*** Bug 1851643 has been marked as a duplicate of this bug. ***

Comment 9 Ole Holm Nielsen 2021-07-09 09:13:46 UTC
We have been bitten by this very same issue on EL8.4.  If a SHA512 password hash contains other than the characters [0-9a-zA-Z./], for example "+", then the user's login is rejected on EL8 systems with a "Failed password" error in /var/log/secure.

Password hashes including other than the characters [0-9a-zA-Z./] as specified in POSIX.1-2017 
https://pubs.opengroup.org/onlinepubs/9699919799.2018edition/functions/crypt.html 
could be generated by external systems or using a command such as "openssl passwd -6 -salt string".

We have tested a CentOS 8 Stream system, and there is no such error in this case, due to the updated libxcrypt version.

Could you please update libxcrypt in EL8.4 ASAP?

Comment 10 Stanislav Zidek 2021-07-09 09:29:32 UTC
Hi Ole, the fix is currently planned to be released in RHEL-8.5 (no promises, but it's almost certain). If you need to address this in any of the previous releases, please go through standard support channel (Red Hat Customer Portal).

Comment 13 errata-xmlrpc 2021-11-09 19:32:37 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (libxcrypt bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:4371