Robert Penz writes: > Hi, On Saturday 12 January 2002 18:06, you wrote: >> The hash function in the CRAM-MD5 calculation requires the original >> plaintext password. The stuff in your system password file is not the >> original plaintext password, and there is no way to recover it.
> i know that, but the stuff is already a md5 hash, No it's not. Furthermore, even if it were, it wouldn't matter a hill of beans. > so you just need to compare > the hash you got from the user with the hash in the shadow file > > ok, that works only on systems that use md5 for password hashing, but redhat > and debian which I use do use it. so a option would be fine. CRAM-MD5 is a hash based on (in general terms) the original plain text password, combined with the randomly-generated salt. More or less. Having only the MD5 hash of just the original plain text password is completely, totally, and utterly useless since you need just the original plaintext password in order to combine it with the randomly-generated salt, and only then compute the resulting hash. Furthermore, the md5-based password file hash is not even a straightforward md5 hash of the password to start with. It is the original plain text password, combined with a randomly-generated salt, and cycled through the MD5 hash function a few hundred times, with some additional intermediate scrambling as well. You're completely off-base. Here's some reading material for you: RFC 2195 Linux-PAM source code -- Sam _______________________________________________ courier-users mailing list [EMAIL PROTECTED] Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users
