Sshole
Source Entity
Hacker News
This analysis explores the evolution of Unix password security, tracing the transition from early, readable /etc/passwd files to modern, encrypted /etc/shadow storage. It highlights Bill Joy's historical implementation of account locking and the technical mechanics of contemporary SHA-512 password verification.
The Evolution of Unix Authentication: From Open Files to Modern Hashes
The Era of Open Transparency
In the early days of computing, specifically around 1980, the Unix security model was vastly different from modern standards. The fundamental password storage mechanism involved the /etc/passwd file, which was globally readable. This file contained usernames alongside their corresponding password hashes, effectively exposing user credentials to any user on the system. While this seems like a massive security oversight by modern standards, it reflects an era where computing environments were smaller, trusted, and less prone to the sophisticated external threats that define the internet age.
Bill Joy and the Daemon Implementation
A pivotal moment in Unix history occurred in 1980 within the 3BSD codebase. Bill Joy, a legendary figure in the development of Unix, introduced a clever mechanism to secure system accounts. For the account designated as 'daemon'—a service account never intended for interactive login—Joy placed an asterisk (*) in the password field. Because an asterisk is not a valid hash, it is impossible for any provided input to generate a matching hash, effectively disabling login for that account. This practice remains a standard security idiom in Unix-like systems today, serving as a testament to the longevity of early architectural decisions.
The Shift to Shadow Files
As computing moved into the 1990s and beyond, the vulnerability of the /etc/passwd file became untenable. The industry transitioned to the /etc/shadow file, a restricted file that houses the actual password hashes, ensuring that even if a user can read the standard password file, they cannot access the authentication secrets. This separation of concerns was a critical step in hardening Unix systems against local privilege escalation and brute-force attacks, fundamentally changing the landscape of system administration.
Modern Password Verification Mechanics
Today, password verification has evolved into a sophisticated cryptographic process. Modern hashes, such as those denoted by $6$ in the shadow file, indicate the use of the SHA-512 hashing algorithm. These entries include a 'salt'—a random string—which ensures that even if two users have the same password, their stored hashes will differ. This prevents the use of pre-computed 'rainbow tables' to crack passwords.
The Verification Workflow
When a user attempts to log in via sshd, the system performs a deterministic check. The sshd daemon retrieves the stored hash, extracts the salt, and applies the same SHA-512 algorithm to the password provided by the user. If the resulting hash matches the one stored in /etc/shadow, the user is granted access. This process is the bedrock of modern Unix security, balancing efficiency with high-level cryptographic integrity.
Concluding Perspectives on Security
The history of Unix authentication is a clear progression from obscurity and simplicity to robust, standardized cryptography. From Bill Joy’s witty label of 'the devil himself' for the daemon account to the implementation of complex salted hashes, these developments demonstrate an ongoing commitment to securing the core of the operating system. Understanding these historical roots is essential for any security professional navigating the complexities of modern server management.