Tool to generate 'phash' style hashed passwords?

[snocc]

We have a need to create password hashes offline, is there a tool or script available to take a cleartext password and generate a phash?

For example, the audit team wants to be able to select a password and generate the hash, so we can later paste into a firewall when provisioning the 'audit' user, even though I would never know what their password actually is.

Something that could run on MS-Windows, batch or Perl script would be easiest.

[kfindlen]

You can use the "request password-hash" command on the CLI of the firewall to generate these.

admin@lab-firewall> request password-hash username user password test1234

$1$tjlcdrco$q/rIosAGEBWJQtFeRy9AX0

[jvalentine]

Here's an off-box method to do something similar:

http://www.insidepro.com/hashes.php?lang=eng

$1$tjlcdrco$q/rIosAGEBWJQtFeRy9AX0

The $ is a delimiter.  1=MD5(Unix) hash type.  rIosAGEBWJQtFeRy9AX0=the hash

If you go to that website, and type out a cleartext password & salt (I don't think the user name is needed on this site), and then click "Generate".  You can scroll down to MD5(Unix) and see the generated hash. 

They provide a little more "behind the scenes" detail here:  http://wiki.insidepro.com/index.php/MD5%28Unix%29

[kfelixdeft]

Does anybody have a new link to the offline phash generator? I'm looking for a means to give my customer access to a tool to generate the phash and then he|she can send me the phash to add to a user profile.  Right now they I'm generating random passwords with openssl or pyhton and sending the password back to the end-user. I rather not continue to do this since I know the password. 

[BPry]

@kfelixdeft,

I'm not sure that you can do this anymore like you used to be able to. You could build out a web portal that uses the firewall's API to gather the generated password hash however, then simply have them send you the output so that you can add it to the configuration. 

[emr_1]

As you are writing down "openssl" as a phash generator, I believe most of users can do that on their computer.

Here is one example:

I used my Windows 10 machine with ubuntu on it (ubuntu was installed by WSL)

c:\>ubuntu

root@MyWindows:~# openssl passwd -5 -salt sampleSALT Password123
$5$sampleSALT$g.faXa7FXwSPDL6dW6fkoNQt7kueN/yfSV3moRtUxE6

On PA device:

Configure new admin user with phash which I generated on the above

admin@PA-VM_OS10(active)# set mgt-config users sampleadmin permissions role-based superuser yes

[edit]
admin@PA-VM_OS10(active)# set mgt-config users sampleadmin phash $5$sampleSALT$g.faXa7FXwSPDL6dW6fkoNQt7kueN/yfSV3moRtUxE6

[edit]

admin@PA-VM_OS10(active)# commit

Commit job 159 is in progress. Use Ctrl+C to return to command prompt
..........55%.70%98%.................100%
Configuration committed successfully

To test this new admin:

Number of failed attempts since last successful login: 0 

sampleadmin@PA-VM_OS10(active)> show admins

Admin From Client Session-start Idle-for Session-expiry
---------------------------------------------------------------------------------------------
* sampleadmin 172.30.10.22 CLI 03/09 13:16:31 00:00:00s 04/08 13:16:31

sampleadmin@PA-VM_OS10(active)>

sampleadmin@PA-VM_OS10(active)> configure
Entering configuration mode
[edit]
sampleadmin@PA-VM_OS10(active)# show mgt-config users sampleadmin
sampleadmin {
permissions {
role-based {
superuser yes;
}
}
phash $5$sampleSALT$g.faXa7FXwSPDL6dW6fkoNQt7kueN/yfSV3moRtUxE6;
}
[edit]
sampleadmin@PA-VM_OS10(active)#

[kfelixdeft]

Okay thanks maybe I should explain the behind the scenes

\

The problem here is my end user probably does not know openssl or could be on a device with no openssl tool ( iOS,  Android, etc  ) .

I was hoping we had a web user interface that would allow for "enter your password", click submit, and then forward me the hash back or the complete user config string

e.g 

set template ORGTEMPLATE config shared local-user-database user john.doe phash $1$test$yV9NHGfaOtf.r/6W1Nqer/

# and that is an example do complain about my weak salt string 😉 

Right now I'm trying to get them to move to a centralized authenticator serves or RADIUS-aaS ( e.g jumpcloud ) since they  have numerous users with various domains and contractors 

Let me keep probing around, I know a password generator tools that salts the passwords has to exist somewhere. Just have to find it.