[chef] RE: Re: Re: Using shadow password on Windows


Chronological Thread 
  • From: Kevin Keane Subscription < >
  • To: < >
  • Subject: [chef] RE: Re: Re: Using shadow password on Windows
  • Date: Mon, 10 Jun 2013 23:52:11 -0700
  • Domainkey-signature: a=rsa-sha1; c=nofws; d=sendgrid.info; h=subject :from:to:mime-version:content-type:in-reply-to:references :sender; q=dns; s=smtpapi; b=a0Z+k4g6AS0ew00PhJoShVK7v687dv5Bcw5 H+yL+9avb7vWyZEPquo0hXABYrQ5rRr2g5W0Jnkwy9cmu+HTYZZ/nbD3pJ5Ptw0C 3CMtpc0kGfAd+FHJ6NWE+vV7uX1qX94rCufGL6GU8GN4clCL/4Hk/Pyh4U0ffr6d FA4LlLCA=

Title: RE: [chef] Re: Re: Using shadow password on Windows
Simple answer: you can't.

More complicated answer: Windows and Linux use completely different, and incompatible, hashing algorithms. Windows simply doesn't understand Linux hashes (and vice versa). That's hardly surprising because these are really vendor-specific decisions. The Samba project had to actually create its own separate password database for Windows compatibility (Google for smbpasswd if you want to learn the details).

Even within Linux, assuming that your hash will work is somewhat iffy. For starters, not all distros support the same hashing algorithms. Fortunately, at least the format tends to be consistent, and the algorithm identified with the $1$ (MD5), as in your sample, is probably the most common one, although it may be the least secure.

If you really want to set the user to a specific fixed password, maybe you can use Active Directory to accomplish that for both Windows and Linux (via Samba) in a very secure way.

-----Original message-----
> From:Andrea Cappelli < "> >
> Sent: Monday 10th June 2013 9:30
> To: ">
> Subject: [chef] Re: Re: Using shadow password on Windows
>
> Il 10/06/2013 18:04, Daniel DeLeo ha scritto:
> > The ruby-shadow gem is for managing the /etc/shadow file on Unix
> > machines.
>
> Uhm, ok, so i misunderstood the documentation.
>
> So the right question is: how can i set a password for a windws user
> knowing only the hash?
>
> If i do
>
> user "test"
> password "$1$wCpUAC5P$NiLw8nU0NjBahe0UPOSo5/"
> end
>
> on a linux box the user test gets the password "test", in windows it
> gets the password $1$wCpUAC5P$NiLw8nU0NjBahe0UPOSo5/
>
> I (wrongly) supposed that with ruby-shadow gem I would obtain the same
> result in both environment
>
> > Chef should not be hitting the code path that requires ruby-shadow on
> > Windows. Can you post the error message you get, an example of
> > cookbook code that causes this, and the output of `ohai platform`?
>
> I have no error message, ohai platform returns
> [
> 'windows'
> ]
>
> Thanks
>



Archive powered by MHonArc 2.6.16.

§