# Creating a password crypt for use in user module.

**URL:** <https://forum.ansible.com/t/creating-a-password-crypt-for-use-in-user-module/12060>\
**Category:** Ansible Project\
**Created:** [November 1, 2012, 1:42pm UTC](https://forum.ansible.com/t/creating-a-password-crypt-for-use-in-user-module/12060 "2012-11-01T13:42:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mark\_Maas](https://avatars.discourse-cdn.com/v4/letter/m/7c8e57/32.png) [@Mark\_Maas](https://forum.ansible.com/u/Mark_Maas)\
**Post date:** [November 1, 2012, 1:42pm UTC](https://forum.ansible.com/t/creating-a-password-crypt-for-use-in-user-module/12060/1 "2012-11-01T13:42:04Z")

</div>

At the risk of becoming a spammer…

I’m looking at the github example and it mentions:

# crypt.crypt(‘This is my Password’, ‘$1$SomeSalt’)

password: $1$SomeSalt$UqddPX3r4kH3UL5jq5/ZI.

Could this example be explained a little more? what is crypt.crypt and I cannot just simple choose my own salt and have it work on a random servers /etc/shadow right?

A tad more insight is needed for this non-programmer (Only bash and, unfortunately, ksh) 😉

Thanks,  
Mark

---

<div class="post-metadata">

**Author:** ![Jeremiah\_Snapp](https://avatars.discourse-cdn.com/v4/letter/j/3bc359/32.png) [@Jeremiah\_Snapp](https://forum.ansible.com/u/Jeremiah_Snapp)\
**Post date:** [November 1, 2012, 1:56pm UTC](https://forum.ansible.com/t/creating-a-password-crypt-for-use-in-user-module/12060/2 "2012-11-01T13:56:19Z")

</div>

crypt.crypt is a python function used to create a salted hash of a password. [http://docs.python.org/2/library/crypt.html](http://docs.python.org/2/library/crypt.html)

Yes you can choose your own salt and have it work on other servers. The /etc/shadow password field format actually includes the salt. Hope that makes sense.

Jeremiah

---

<div class="post-metadata">

**Author:** ![Nigel\_Metheringham](https://avatars.discourse-cdn.com/v4/letter/n/3ec8ea/32.png) [@Nigel\_Metheringham](https://forum.ansible.com/u/Nigel_Metheringham)\
**Post date:** [March 6, 2013, 9:27am UTC](https://forum.ansible.com/t/creating-a-password-crypt-for-use-in-user-module/12060/3 "2013-03-06T09:27:42Z")

</div>

crucialfelix wrote:

> its still a bit mysterious
> 
> the github example says:
> 
> # created with:  
> # crypt.crypt('This is my Password', '$1$SomeSalt')  
> password: $1$SomeSalt$UqddPX3r4kH3UL5jq5/ZI.

So if I try that on a Centos 6 machine, then thats exactly what I get...

but run it on a Mac OS 10.8.2, then...

> but if I actually run this code I get:
> 
> crypt.crypt('This is my Password', '$1$SomeSalt')  
> '$15Dq6xVfTuV6'

This is going to be down to the OS / libc crypt implementation - try man 3 crypt

On the Mac it appears to be an ancient and venerable DES crypt only - so only the first 2 characters of the salt are used, and quite likely only the first 8 characters of the password, and you get a 13 character result (including 2 characters of salt).

Modern crypt implementations can do DES, but normally key off the first few characters of the salt to select a crypt algorithm - $1$ is MD5 based, $2a$ is Blowfish, $5$ is SHA256, $6$ SHA512 and there is also one for bcrypt but I don't have that around to check.

> which bears no resemblance to what is shown and suggests that something  
> is wrong with the example.

Its system dependent to some degree. The vast majority of modern systems will have a decently modern crypt. The Mac I guess has not because they don't use that subsystem at all for its internal password management - anyone want to see what happens if you set passwords on accounts on a Mac using ansible??

&nbsp;&nbsp;Nigel.