Come puoi leggi in questo manuale che risale in buona parte nel 2002:
At the end of the installation, you will be asked if shadow passwords
should be enabled. Answer yes to this question, so passwords will be
kept in the file '/etc/shadow'. Only the root user and the group
shadow have read access to this file, so no users will be able to grab
a copy of this file in order to run a password cracker against it.
You can switch between shadow passwords and normal passwords at any
time by using 'shadowconfig'.
Read more on Shadow passwords in Shadow Password
(http://www.linuxdoc.org/HOWTO/Shadow-Password-HOWTO.html)
('/usr/share/doc/HOWTO/en-txt/Shadow-Password.txt.gz').
Furthermore, you are queried during installation whether you want to
use MD5 hashed passwords. This is generally a very good idea since it
allows longer passwords and better encryption. MD5 allows for
passwords longer than 8 characters. This, if used wisely, can make it
more difficult for attackers to brute-force the system's passwords.
Regarding MD5 passwords, this is the default option when installing
the latest 'password' package. You can change this anytime after
installation by doing 'dpkg-reconfigure -plow passwd'. You can
recognize md5 passwords in the '/etc/shadow' file by their $1$ prefix.
This, as a matter of fact, modifies all files under '/etc/pam.d' by
substituting the password line and include md5 in it:
password required pam_unix.so md5 nullok obscure min=6 max=16
If 'max' is not set over 8 the change will not be useful at all. For
more information on this read Section 4.10.1, 'User authentication:
PAM'.
Note: the default configuration in Debian, even when activating MD5
passwords, does not modify the previously set 'max' value.
Questo non è il modo predefinito in cui le password vengono sottoposte a hash in debian.
Nel capitolo 4.11.1.1 Sicurezza della password in PAM può leggere che l'opzione predefinita è sha512 da Debian Squeeze (2009).
You have to make sure that the pam_unix.so module uses the "sha512" option to use encrypted passwords. This is the default in Debian Squeeze.
The line with the definition of the pam_unix module will look
something like:
password [success=1 default=ignore] pam_unix.so nullok obscure minlen=8 sha512
Il problema con questi manuali è che ci sono alcune parti che sono obsolete. La comunità cerca di risolvere questo tipo di problemi se li fai segnalare, e puoi anche offrirti volontario per riparare quella parte della documentazione.