Tool to generate 'phash' style hashed passwords?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Tool to generate 'phash' style hashed passwords?

L0 Member

We have a need to create password hashes offline, is there a tool or script available to take a cleartext password and generate a phash?

For example, the audit team wants to be able to select a password and generate the hash, so we can later paste into a firewall when provisioning the 'audit' user, even though I would never know what their password actually is.

Something that could run on MS-Windows, batch or Perl script would be easiest.

6 REPLIES 6

L4 Transporter

You can use the "request password-hash" command on the CLI of the firewall to generate these.

admin@lab-firewall> request password-hash username user password test1234

$1$tjlcdrco$q/rIosAGEBWJQtFeRy9AX0

L7 Applicator

Here's an off-box method to do something similar:

http://www.insidepro.com/hashes.php?lang=eng

$1$tjlcdrco$q/rIosAGEBWJQtFeRy9AX0


The $ is a delimiter.  1=MD5(Unix) hash type.  rIosAGEBWJQtFeRy9AX0=the hash


If you go to that website, and type out a cleartext password & salt (I don't think the user name is needed on this site), and then click "Generate".  You can scroll down to MD5(Unix) and see the generated hash. 


They provide a little more "behind the scenes" detail here:  http://wiki.insidepro.com/index.php/MD5%28Unix%29

L0 Member

Does anybody have a new link to the offline phash generator? I'm looking for a means to give my customer access to a tool to generate the phash and then he|she can send me the phash to add to a user profile.  Right now they I'm generating random passwords with openssl or pyhton and sending the password back to the end-user. I rather not continue to do this since I know the password. 

 

Cyber Elite
Cyber Elite

@kfelixdeft,

I'm not sure that you can do this anymore like you used to be able to. You could build out a web portal that uses the firewall's API to gather the generated password hash however, then simply have them send you the output so that you can add it to the configuration. 

As you are writing down "openssl" as a phash generator, I believe most of users can do that on their computer.


Here is one example:

I used my Windows 10 machine with ubuntu on it (ubuntu was installed by WSL)

 

c:\>ubuntu


root@MyWindows:~# openssl passwd -5 -salt sampleSALT Password123
$5$sampleSALT$g.faXa7FXwSPDL6dW6fkoNQt7kueN/yfSV3moRtUxE6

 

On PA device:

Configure new admin user with phash which I generated on the above

 

admin@PA-VM_OS10(active)# set mgt-config users sampleadmin permissions role-based superuser yes

[edit]
admin@PA-VM_OS10(active)# set mgt-config users sampleadmin phash $5$sampleSALT$g.faXa7FXwSPDL6dW6fkoNQt7kueN/yfSV3moRtUxE6

[edit]

admin@PA-VM_OS10(active)# commit

Commit job 159 is in progress. Use Ctrl+C to return to command prompt
..........55%.70%98%.................100%
Configuration committed successfully

 

 

To test this new admin:

Number of failed attempts since last successful login: 0 

 

sampleadmin@PA-VM_OS10(active)> show admins

Admin From Client Session-start Idle-for Session-expiry
---------------------------------------------------------------------------------------------
* sampleadmin 172.30.10.22 CLI 03/09 13:16:31 00:00:00s 04/08 13:16:31

sampleadmin@PA-VM_OS10(active)>


sampleadmin@PA-VM_OS10(active)> configure
Entering configuration mode
[edit]
sampleadmin@PA-VM_OS10(active)# show mgt-config users sampleadmin
sampleadmin {
permissions {
role-based {
superuser yes;
}
}
phash $5$sampleSALT$g.faXa7FXwSPDL6dW6fkoNQt7kueN/yfSV3moRtUxE6;
}
[edit]
sampleadmin@PA-VM_OS10(active)#

L0 Member

Okay thanks maybe I should explain the behind the scenes

\

The problem here is my end user probably does not know openssl or could be on a device with no openssl tool ( iOS,  Android, etc  ) .

 

I was hoping we had a web user interface that would allow for "enter your password", click submit, and then forward me the hash back or the complete user config string

 

e.g 

 

 

set template ORGTEMPLATE config shared local-user-database user john.doe phash $1$test$yV9NHGfaOtf.r/6W1Nqer/

# and that is an example do complain about my weak salt string 😉 

 

 

Right now I'm trying to get them to move to a centralized authenticator serves or RADIUS-aaS ( e.g jumpcloud ) since they  have numerous users with various domains and contractors 

 

Let me keep probing around, I know a password generator tools that salts the passwords has to exist somewhere. Just have to find it.

 

 

 

  • 10433 Views
  • 6 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!