[GH-ISSUE #1253] password scheme {MD5-CRYPT} #1018

New issue

Closed

opened 2026-02-27 11:14:46 +03:00 by kerem · 1 comment

kerem commented

2026-02-27 11:14:46 +03:00

Owner

Originally created by @moumour on GitHub (Sep 27, 2017).
Original GitHub issue: https://github.com/modoboa/modoboa/issues/1253

Impacted versions

Modoboa: 1.9.
installer used: Yes
Webserver: Nginx

The scheme {MD5-CRYPT} produce a hash with $1 at the first character
usually in the password /etc/shadow first character $1 mean: $1 = MD5 hashing algorithm, but after the first 1 has one more with the salt, after the salt has one more $ with the md5 hash of password.
Your {MD5-CRYPT} scheme has only $1 without salt.
{MD5-CRYPT} scheme is the same as MD5 with additional $1? or the {MD5-CRYPT} scheme support salt?

Originally created by @moumour on GitHub (Sep 27, 2017). Original GitHub issue: https://github.com/modoboa/modoboa/issues/1253 # Impacted versions * Modoboa: 1.9. * installer used: Yes * Webserver: Nginx The scheme {MD5-CRYPT} produce a hash with $1 at the first character usually in the password /etc/shadow first character $1 mean: $1 = MD5 hashing algorithm, but after the first $1 has one more $ with the salt, after the salt has one more $ with the md5 hash of password. Your {MD5-CRYPT} scheme has only $1 without salt. {MD5-CRYPT} scheme is the same as MD5 with additional $1? or the {MD5-CRYPT} scheme support salt?

kerem

2026-02-27 11:14:46 +03:00

closed this issue
added the
question
label

kerem commented

2026-02-27 11:14:46 +03:00

Author

Owner

@tonioo commented on GitHub (Oct 6, 2017):

Modoboa relies on passlib to hash passwords. Looks like MD5Crypt supports salt (http://passlib.readthedocs.io/en/stable/lib/passlib.hash.md5_crypt.html).

@tonioo commented on GitHub (Oct 6, 2017): Modoboa relies on ``passlib`` to hash passwords. Looks like MD5Crypt supports salt (http://passlib.readthedocs.io/en/stable/lib/passlib.hash.md5_crypt.html).

kerem referenced this issue

2026-02-27 11:20:50 +03:00

[PR #1018] [MERGED] Control DNS checks per domain. #2089