mjhjmtu

Related to Why is the root password on Linux Mint my user password?

It appears that my Mint 17.3 box has a root password set: I see a password hash in /etc/shadow (it starts with $6$...). I'd like to compare this password hash with my (known) user password.

For whatever reason, I don't trust su - (in the linked question) to not use my password, vs. the root password.

Is there a simple way (in bash, e.g.) to compare a known hash with a known password and see if they match?

Find the salt used in /etc/shadow, it's the characters between the second and third $, usually there will be eight.

Use mkpasswd -m sha-512 -S <salt>, and enter the password you think it's suposed to be when it asks. It will output the hash with $6$<salt>$ prefixed.

In the end, you need to call the crypt(3) function from the libcrypt (which on GNU systems like Linux Mint comes with the GNU libc) with the password as first argument and the hash ($6$...) as second argument.

python is one such tool that exposes that function, so you can do:

HASH='$6$...' python2 -c 'import crypt, os, getpass
print(crypt.crypt(getpass.getpass(), os.environ["HASH"]))'

And if the output matches the hash, that was the right password.

$HASH above can be either the full hash (like $6$rounds=1234$somesalt$6eFBNhSgwEwdfZBHueBedpcqaVKGcV2DJy/tQMFd3JL88hwvgTkISJShnOUrbtP1fRs8I9rGIdsgWCoiujxD2/) or just the part of it up to the rightmost $, that is including the salt and optional round count ($6$rounds=1234$somesalt$).

Or you can do the verification in python:

HASH='$6$...' python2 -c '
import crypt, os, getpass
hash = os.environ["HASH"]
if crypt.crypt(getpass.getpass(), hash) == hash:
 print "OK"
else:
 print "Wrong password"'

(then obviously, $HASH has to contain the full hash).

With python, you can also call functions from arbitrary libraries using the ctypes module. So another way to call the system's crypt() function (not that you'd need to as crypt is one of the standard modules, it's just that I was earlier under the impression that the crypt module came with its own separate crypt() implementation) is with something like:

HASH='$6$...' python2 -c '
from ctypes import *
import os, getpass
l = CDLL("libcrypt.so.1")
l.crypt.restype = c_char_p
print l.crypt(getpass.getpass(), os.environ["HASH"])'

ssh root@localhost comes to mind, though your distribution may have disabled password-based login for root entirely and/or installed a keypair; or logging in on your usual graphical login screen as user root. (Even if you have automatic login enabled, the shutdown dialog may offer to login as another user.)