How do I create a unix password hash with php

Question

I'm trying to create system users with a php script securely, In that, I'd like to be able to hash the password with the php script, so that their password shows up nowhere in the bash history.

How to I take a string, and hash it so it is a unix password hash?

$UX_PW = some_function('my_password');
exec("useradd -p $UX_PW newusername");

Answer 1

Depending on your system, you're either looking for crypt() or md5().

Traditionally, unix uses DES-encrypted passwords (thats the 'crypt' function), with a 2-character salt (two random characters from the set [a-zA-Z0-9./]) which is prepended to the hash to perturb the algorithm.

Newer systems often use MD5 though.

Answer 2

It's crypt() that implements the UNIX password hashing.
http://us.php.net/manual/en/function.crypt.php

Answer 3

Use crypt. Recent linux/unixes use CRYPT_MD5 or CRYPT_BLOWFISH. MD5 is the most widely supported one. DES's are for old systems.

Also I should note that the MD5 version is not a simple MD5 sum operation, it also uses a "salt" value to make hashes not-precalculatable. [[ I made up this term :) ]]

Answer 4

The password-hashing used on UNIX, Linux, and other UNIX-like POSIX operating systems varies a lot. Most "passwd" hashing methods uses a modified DES algorithm (not true DES), they may apply the hashing to the input multiple times, and they use a salt of 16 or 24 bits. A specific answer of the method to produce a passwd-compatible hash depends on which operating system you're using.

The crypt() system call should be the way to do password hashing according to your operating system. You can access it in PHP using the function crypt().

As for which crypt algorithm to use, this depends on your operating system.

Answer 5

From the Ubuntu Intrepid man page on passwd (change password)

The security of a password depends upon the strength of the encryption algorithm and the size of the key space. The UNIX System encryption method is based on the NBS DES algorithm and is very secure. The size of the key space depends upon the randomness of the password which is selected.

Also, instead of using crypt() you may prefer hash() because this allows you to keep the string setting for the hash algorithm elsewhere. If your code needs to use a different hash algorithm for other environments, you'll only have to change the string and not the name of the function.