diff -up yp-tools-2.12/man/yppasswd.1.in.hash yp-tools-2.12/man/yppasswd.1.in --- yp-tools-2.12/man/yppasswd.1.in.hash 2011-09-09 16:18:49.469037058 +0200 +++ yp-tools-2.12/man/yppasswd.1.in 2011-09-09 16:20:19.101030930 +0200 @@ -81,6 +81,12 @@ for authentication with the .BR yppasswdd (8) daemon. Subsequently, the program prompts for the updated information: +.P +If we use shadowing passwords using passwd.adjunct, SHA-512 will be +used for hashing a new password by default. If we want to use MD5, +SHA_256 or older DES, we need to set the environment variable +YP_PASSWD_HASH. Possible values are "DES", "MD5", "SHA-256" and +"SHA-512" (value is case-insensitive). .\" .\" .IP "\fByppasswd\fP or \fB-p\fP" diff -up yp-tools-2.12/src/yppasswd.c.hash yp-tools-2.12/src/yppasswd.c --- yp-tools-2.12/src/yppasswd.c.hash 2011-09-09 16:20:35.360029823 +0200 +++ yp-tools-2.12/src/yppasswd.c 2011-09-09 16:25:21.589010245 +0200 @@ -514,6 +514,32 @@ create_random_salt (char *salt, int num_ close (fd); } + +/* + * Reads environment variable YP_PASSWD_HASH and returns hash id. + * Possible values are MD5, SHA-256, SHA-512 and DES. + * If other value is set or it is not set at all, SHA-512 is used. + */ +static int +get_env_hash_id() +{ + const char *v = getenv("YP_PASSWD_HASH"); + if (!v) + return SHA_512; + + if (!strcasecmp(v, "DES")) + return DES; + + if (!strcasecmp(v, "SHA-256")) + return SHA_256; + + if (!strcasecmp(v, "MD5")) + return MD5; + + return SHA_512; +} + + int main (int argc, char **argv) { @@ -723,6 +749,15 @@ main (int argc, char **argv) hash_id = get_hash_id (pwd->pw_passwd); + /* If we use passwd.adjunct, there is no magic value like $1$ in the + * beginning of password, but ##username instead. Thus, SHA_512 will be + * used for hashing a new password by default. If we want to use DES, + * MD5 or SHA_256, we need to set the environment variable + * YP_PASSWD_HASH (e.g. YP_PASSWD_HASH=DES). + */ + if (strncmp(pwd->pw_passwd, "##", 2) == 0) + hash_id = get_env_hash_id(); + /* Preserve 'rounds=$' (if present) in case of SHA-2 */ if (hash_id == SHA_256 || hash_id == SHA_512) {