06-21-2013 11:39 AM
We have a need to create password hashes offline, is there a tool or script available to take a cleartext password and generate a phash?
For example, the audit team wants to be able to select a password and generate the hash, so we can later paste into a firewall when provisioning the 'audit' user, even though I would never know what their password actually is.
Something that could run on MS-Windows, batch or Perl script would be easiest.
06-21-2013 11:45 AM
06-21-2013 12:14 PM
Here's an off-box method to do something similar:
The $ is a delimiter. 1=MD5(Unix) hash type. rIosAGEBWJQtFeRy9AX0=the hash
If you go to that website, and type out a cleartext password & salt (I don't think the user name is needed on this site), and then click "Generate". You can scroll down to MD5(Unix) and see the generated hash.
They provide a little more "behind the scenes" detail here: http://wiki.insidepro.com/index.php/MD5%28Unix%29
03-08-2023 09:17 AM
Does anybody have a new link to the offline phash generator? I'm looking for a means to give my customer access to a tool to generate the phash and then he|she can send me the phash to add to a user profile. Right now they I'm generating random passwords with openssl or pyhton and sending the password back to the end-user. I rather not continue to do this since I know the password.
03-08-2023 02:13 PM
I'm not sure that you can do this anymore like you used to be able to. You could build out a web portal that uses the firewall's API to gather the generated password hash however, then simply have them send you the output so that you can add it to the configuration.
03-08-2023 08:29 PM
As you are writing down "openssl" as a phash generator, I believe most of users can do that on their computer.
Here is one example:
I used my Windows 10 machine with ubuntu on it (ubuntu was installed by WSL)
root@MyWindows:~# openssl passwd -5 -salt sampleSALT Password123
On PA device:
Configure new admin user with phash which I generated on the above
admin@PA-VM_OS10(active)# set mgt-config users sampleadmin permissions role-based superuser yes
admin@PA-VM_OS10(active)# set mgt-config users sampleadmin phash $5$sampleSALT$g.faXa7FXwSPDL6dW6fkoNQt7kueN/yfSV3moRtUxE6
Commit job 159 is in progress. Use Ctrl+C to return to command prompt
Configuration committed successfully
To test this new admin:
Number of failed attempts since last successful login: 0
sampleadmin@PA-VM_OS10(active)> show admins
Admin From Client Session-start Idle-for Session-expiry
* sampleadmin 172.30.10.22 CLI 03/09 13:16:31 00:00:00s 04/08 13:16:31
Entering configuration mode
sampleadmin@PA-VM_OS10(active)# show mgt-config users sampleadmin
03-13-2023 11:12 AM
Okay thanks maybe I should explain the behind the scenes
The problem here is my end user probably does not know openssl or could be on a device with no openssl tool ( iOS, Android, etc ) .
I was hoping we had a web user interface that would allow for "enter your password", click submit, and then forward me the hash back or the complete user config string
set template ORGTEMPLATE config shared local-user-database user john.doe phash $1$test$yV9NHGfaOtf.r/6W1Nqer/
# and that is an example do complain about my weak salt string 😉
Right now I'm trying to get them to move to a centralized authenticator serves or RADIUS-aaS ( e.g jumpcloud ) since they have numerous users with various domains and contractors
Let me keep probing around, I know a password generator tools that salts the passwords has to exist somewhere. Just have to find it.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!