Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
When creating a password hash using python crypt works in RHEL 6 and 7 but fails in RHEL 8
Version-Release number of selected component (if applicable):
glibc-2.28-101.el8.x86_64
How reproducible:
Always
Steps to Reproduce:
1. See Additional info
Actual results:
Failed login on RHEL 8
Expected results:
Successful login on RHEL 8
Additional info:
On Red Hat 6 create the password hash
[root@rhel6 ~]# cat passwd.sh
password=redhat
SALT=`date +%s | base64`"\$"
HASH512=`python -c "import crypt; print crypt.crypt('${password}','\\$6\\$$SALT')"`
echo Hash: $HASH512
[root@rhel6 ~]# ./passwd.sh
Hash: $6$MTYwNTgxMzc4Nwo=$AzrYpEqcRH2Iypn.DNj3YOzjiBkBFtp.X5enC4bOsUI0f93ufGVhU.rFUFwSf7dQf4FjpdJ1mveVs/6nhbmgW/
[root@rhel6 ~]# adduser testuser
[root@rhel6 ~]# echo 'testuser:$6$MTYwNTgxMzc4Nwo=$AzrYpEqcRH2Iypn.DNj3YOzjiBkBFtp.X5enC4bOsUI0f93ufGVhU.rFUFwSf7dQf4FjpdJ1mveVs/6nhbmgW/' | chpasswd -e
[root@rhel6 ~]# grep testuser /etc/shadow
testuser:$6$MTYwNTgxMzc4Nwo=$AzrYpEqcRH2Iypn.DNj3YOzjiBkBFtp.X5enC4bOsUI0f93ufGVhU.rFUFwSf7dQf4FjpdJ1mveVs/6nhbmgW/:18585:0:99999:7:::
[root@rhel6 ~]# ssh testuser.0.1
The authenticity of host '127.0.0.1 (127.0.0.1)' can't be established.
RSA key fingerprint is e8:87:08:2b:26:6f:94:49:64:4f:aa:26:74:f4:01:57.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '127.0.0.1' (RSA) to the list of known hosts.
testuser.0.1's password:
[testuser@rhel6 ~]$
-------------------------------------------------------------------------------------------------------------
Test on RHEL 7
[root@rhel7 ~]# adduser testuser
[root@rhel7 ~]# echo 'testuser:$6$MTYwNTgxMzc4Nwo=$AzrYpEqcRH2Iypn.DNj3YOzjiBkBFtp.X5enC4bOsUI0f93ufGVhU.rFUFwSf7dQf4FjpdJ1mveVs/6nhbmgW/' | chpasswd -e
[root@rhel7 ~]# grep testuser /etc/shadow
testuser:$6$MTYwNTgxMzc4Nwo=$AzrYpEqcRH2Iypn.DNj3YOzjiBkBFtp.X5enC4bOsUI0f93ufGVhU.rFUFwSf7dQf4FjpdJ1mveVs/6nhbmgW/:18585:0:99999:7:::
[root@rhel7 ~]# ssh testuser.0.1
The authenticity of host '127.0.0.1 (<no hostip for proxy command>)' can't be established.
ECDSA key fingerprint is SHA256:g1UrtI+ArH2KqXgql056E5TAXqAcD5PSMVbbFJLeNi0.
ECDSA key fingerprint is MD5:82:b4:dc:c4:44:5a:cf:1c:4b:59:de:ce:3e:23:be:5c.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts.
Password:
[testuser@rhel7 ~]$
-------------------------------------------------------------------------------------------------------------
Then test on RHEL 8 which fails
[root@rhel8 ~]# adduser testuser
[root@rhel8 ~]# echo 'testuser:$6$MTYwNTgxMzc4Nwo=$AzrYpEqcRH2Iypn.DNj3YOzjiBkBFtp.X5enC4bOsUI0f93ufGVhU.rFUFwSf7dQf4FjpdJ1mveVs/6nhbmgW/' | chpasswd -e
[root@rhel8 ~]# grep testuser /etc/shadow
testuser:$6$MTYwNTgxMzc4Nwo=$AzrYpEqcRH2Iypn.DNj3YOzjiBkBFtp.X5enC4bOsUI0f93ufGVhU.rFUFwSf7dQf4FjpdJ1mveVs/6nhbmgW/:18585:0:99999:7:::
[root@rhel8 ~]# ssh testuser.0.1
The authenticity of host '127.0.0.1 (<no hostip for proxy command>)' can't be established.
ECDSA key fingerprint is SHA256:p3lgOPmFQmvQHIQLS+9S63WnbeeBGgsy/FKjGJzLyBg.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts.
Password:
Password:
Password:
testuser.0.1's password:
Permission denied, please try again.
testuser.0.1's password:
Permission denied, please try again.
testuser.0.1's password:
Received disconnect from UNKNOWN port 65535:2: Too many authentication failures
Disconnected from UNKNOWN port 65535
Nov 19 14:55:41 swzc1pridm21 sshd[33407]: error: PAM: Authentication failure for testuser from 127.0.0.1
Nov 19 14:55:43 swzc1pridm21 unix_chkpwd[33425]: password check failed for user (testuser)
Nov 19 14:55:43 swzc1pridm21 sshd[33423]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.0.0.1 user=testuser
Nov 19 14:55:45 swzc1pridm21 sshd[33407]: error: PAM: Authentication failure for testuser from 127.0.0.1
Nov 19 14:55:47 swzc1pridm21 unix_chkpwd[33427]: password check failed for user (testuser)
Nov 19 14:55:47 swzc1pridm21 sshd[33426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.0.0.1 user=testuser
Nov 19 14:55:49 swzc1pridm21 sshd[33407]: error: PAM: Authentication failure for testuser from 127.0.0.1
Nov 19 14:55:52 swzc1pridm21 unix_chkpwd[33428]: password check failed for user (testuser)
Nov 19 14:55:52 swzc1pridm21 sshd[33407]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.0.0.1 user=testuser
Nov 19 14:55:54 swzc1pridm21 sshd[33407]: Failed password for testuser from 127.0.0.1 port 38008 ssh2
Nov 19 14:56:00 swzc1pridm21 unix_chkpwd[33429]: password check failed for user (testuser)
Nov 19 14:56:01 swzc1pridm21 sshd[33407]: Failed password for testuser from 127.0.0.1 port 38008 ssh2
Nov 19 14:56:05 swzc1pridm21 unix_chkpwd[33430]: password check failed for user (testuser)
Nov 19 14:56:07 swzc1pridm21 sshd[33407]: Failed password for testuser from 127.0.0.1 port 38008 ssh2
Nov 19 14:56:08 swzc1pridm21 sshd[33407]: error: maximum authentication attempts exceeded for testuser from 127.0.0.1 port 38008 ssh2 [preauth]
Nov 19 14:56:08 swzc1pridm21 sshd[33407]: Disconnecting authenticating user testuser 127.0.0.1 port 38008: Too many authentication failures [preauth]
Nov 19 14:56:08 swzc1pridm21 sshd[33407]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.0.0.1 user=testuser
-------------------------------------------------------------------------------------------------------------
If I set the password to the same password it does work
[root@rhel8 ~]# passwd testuser
Changing password for user testuser.
New password:
BAD PASSWORD: The password is shorter than 8 characters
Retype new password:
passwd: all authentication tokens updated successfully.
[root@rhel8 ~]# ssh testuser.0.1
Password:
Last failed login: Thu Nov 19 15:01:11 EST 2020 from 127.0.0.1 on ssh:notty
There were 11 failed login attempts since the last successful login.
[testuser@rhel8 ~]$
We have been bitten by this very same issue on EL8.4. If a SHA512 password hash contains other than the characters [0-9a-zA-Z./], for example "+", then the user's login is rejected on EL8 systems with a "Failed password" error in /var/log/secure.
Password hashes including other than the characters [0-9a-zA-Z./] as specified in POSIX.1-2017
https://pubs.opengroup.org/onlinepubs/9699919799.2018edition/functions/crypt.html
could be generated by external systems or using a command such as "openssl passwd -6 -salt string".
We have tested a CentOS 8 Stream system, and there is no such error in this case, due to the updated libxcrypt version.
Could you please update libxcrypt in EL8.4 ASAP?
Hi Ole, the fix is currently planned to be released in RHEL-8.5 (no promises, but it's almost certain). If you need to address this in any of the previous releases, please go through standard support channel (Red Hat Customer Portal).
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (libxcrypt bug fix and enhancement update), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2021:4371
Description of problem: When creating a password hash using python crypt works in RHEL 6 and 7 but fails in RHEL 8 Version-Release number of selected component (if applicable): glibc-2.28-101.el8.x86_64 How reproducible: Always Steps to Reproduce: 1. See Additional info Actual results: Failed login on RHEL 8 Expected results: Successful login on RHEL 8 Additional info: On Red Hat 6 create the password hash [root@rhel6 ~]# cat passwd.sh password=redhat SALT=`date +%s | base64`"\$" HASH512=`python -c "import crypt; print crypt.crypt('${password}','\\$6\\$$SALT')"` echo Hash: $HASH512 [root@rhel6 ~]# ./passwd.sh Hash: $6$MTYwNTgxMzc4Nwo=$AzrYpEqcRH2Iypn.DNj3YOzjiBkBFtp.X5enC4bOsUI0f93ufGVhU.rFUFwSf7dQf4FjpdJ1mveVs/6nhbmgW/ [root@rhel6 ~]# adduser testuser [root@rhel6 ~]# echo 'testuser:$6$MTYwNTgxMzc4Nwo=$AzrYpEqcRH2Iypn.DNj3YOzjiBkBFtp.X5enC4bOsUI0f93ufGVhU.rFUFwSf7dQf4FjpdJ1mveVs/6nhbmgW/' | chpasswd -e [root@rhel6 ~]# grep testuser /etc/shadow testuser:$6$MTYwNTgxMzc4Nwo=$AzrYpEqcRH2Iypn.DNj3YOzjiBkBFtp.X5enC4bOsUI0f93ufGVhU.rFUFwSf7dQf4FjpdJ1mveVs/6nhbmgW/:18585:0:99999:7::: [root@rhel6 ~]# ssh testuser.0.1 The authenticity of host '127.0.0.1 (127.0.0.1)' can't be established. RSA key fingerprint is e8:87:08:2b:26:6f:94:49:64:4f:aa:26:74:f4:01:57. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '127.0.0.1' (RSA) to the list of known hosts. testuser.0.1's password: [testuser@rhel6 ~]$ ------------------------------------------------------------------------------------------------------------- Test on RHEL 7 [root@rhel7 ~]# adduser testuser [root@rhel7 ~]# echo 'testuser:$6$MTYwNTgxMzc4Nwo=$AzrYpEqcRH2Iypn.DNj3YOzjiBkBFtp.X5enC4bOsUI0f93ufGVhU.rFUFwSf7dQf4FjpdJ1mveVs/6nhbmgW/' | chpasswd -e [root@rhel7 ~]# grep testuser /etc/shadow testuser:$6$MTYwNTgxMzc4Nwo=$AzrYpEqcRH2Iypn.DNj3YOzjiBkBFtp.X5enC4bOsUI0f93ufGVhU.rFUFwSf7dQf4FjpdJ1mveVs/6nhbmgW/:18585:0:99999:7::: [root@rhel7 ~]# ssh testuser.0.1 The authenticity of host '127.0.0.1 (<no hostip for proxy command>)' can't be established. ECDSA key fingerprint is SHA256:g1UrtI+ArH2KqXgql056E5TAXqAcD5PSMVbbFJLeNi0. ECDSA key fingerprint is MD5:82:b4:dc:c4:44:5a:cf:1c:4b:59:de:ce:3e:23:be:5c. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts. Password: [testuser@rhel7 ~]$ ------------------------------------------------------------------------------------------------------------- Then test on RHEL 8 which fails [root@rhel8 ~]# adduser testuser [root@rhel8 ~]# echo 'testuser:$6$MTYwNTgxMzc4Nwo=$AzrYpEqcRH2Iypn.DNj3YOzjiBkBFtp.X5enC4bOsUI0f93ufGVhU.rFUFwSf7dQf4FjpdJ1mveVs/6nhbmgW/' | chpasswd -e [root@rhel8 ~]# grep testuser /etc/shadow testuser:$6$MTYwNTgxMzc4Nwo=$AzrYpEqcRH2Iypn.DNj3YOzjiBkBFtp.X5enC4bOsUI0f93ufGVhU.rFUFwSf7dQf4FjpdJ1mveVs/6nhbmgW/:18585:0:99999:7::: [root@rhel8 ~]# ssh testuser.0.1 The authenticity of host '127.0.0.1 (<no hostip for proxy command>)' can't be established. ECDSA key fingerprint is SHA256:p3lgOPmFQmvQHIQLS+9S63WnbeeBGgsy/FKjGJzLyBg. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts. Password: Password: Password: testuser.0.1's password: Permission denied, please try again. testuser.0.1's password: Permission denied, please try again. testuser.0.1's password: Received disconnect from UNKNOWN port 65535:2: Too many authentication failures Disconnected from UNKNOWN port 65535 Nov 19 14:55:41 swzc1pridm21 sshd[33407]: error: PAM: Authentication failure for testuser from 127.0.0.1 Nov 19 14:55:43 swzc1pridm21 unix_chkpwd[33425]: password check failed for user (testuser) Nov 19 14:55:43 swzc1pridm21 sshd[33423]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.0.0.1 user=testuser Nov 19 14:55:45 swzc1pridm21 sshd[33407]: error: PAM: Authentication failure for testuser from 127.0.0.1 Nov 19 14:55:47 swzc1pridm21 unix_chkpwd[33427]: password check failed for user (testuser) Nov 19 14:55:47 swzc1pridm21 sshd[33426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.0.0.1 user=testuser Nov 19 14:55:49 swzc1pridm21 sshd[33407]: error: PAM: Authentication failure for testuser from 127.0.0.1 Nov 19 14:55:52 swzc1pridm21 unix_chkpwd[33428]: password check failed for user (testuser) Nov 19 14:55:52 swzc1pridm21 sshd[33407]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.0.0.1 user=testuser Nov 19 14:55:54 swzc1pridm21 sshd[33407]: Failed password for testuser from 127.0.0.1 port 38008 ssh2 Nov 19 14:56:00 swzc1pridm21 unix_chkpwd[33429]: password check failed for user (testuser) Nov 19 14:56:01 swzc1pridm21 sshd[33407]: Failed password for testuser from 127.0.0.1 port 38008 ssh2 Nov 19 14:56:05 swzc1pridm21 unix_chkpwd[33430]: password check failed for user (testuser) Nov 19 14:56:07 swzc1pridm21 sshd[33407]: Failed password for testuser from 127.0.0.1 port 38008 ssh2 Nov 19 14:56:08 swzc1pridm21 sshd[33407]: error: maximum authentication attempts exceeded for testuser from 127.0.0.1 port 38008 ssh2 [preauth] Nov 19 14:56:08 swzc1pridm21 sshd[33407]: Disconnecting authenticating user testuser 127.0.0.1 port 38008: Too many authentication failures [preauth] Nov 19 14:56:08 swzc1pridm21 sshd[33407]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.0.0.1 user=testuser ------------------------------------------------------------------------------------------------------------- If I set the password to the same password it does work [root@rhel8 ~]# passwd testuser Changing password for user testuser. New password: BAD PASSWORD: The password is shorter than 8 characters Retype new password: passwd: all authentication tokens updated successfully. [root@rhel8 ~]# ssh testuser.0.1 Password: Last failed login: Thu Nov 19 15:01:11 EST 2020 from 127.0.0.1 on ssh:notty There were 11 failed login attempts since the last successful login. [testuser@rhel8 ~]$