In this lesson, you will learn how to balance computational cost and security when selecting password hashing algorithms to defend against brute-force attacks.
When a user logs into a Linux system, the OS does not store their actual password. Instead, it stores a "hash"—a one-way mathematical fingerprint of the password. If a malicious actor gains access to your /etc/shadow file, they cannot see the original passwords, but they can attempt to guess them by hashing millions of variations and comparing them to the stolen data. This is where hashing algorithms and entropy become critical.
Choosing the Right Algorithm
Older systems used MD5 or SHA-256, which are mathematically fast. While speed is great for file integrity, it is a disaster for password security; an attacker can compute billions of these hashes per second. Modern Linux distributions prefer "slow" algorithms like yescrypt or bcrypt. These are intentionally designed to be computationally expensive, forcing an attacker to spend significantly more time and hardware resources to verify a single guess.
You can check which algorithm your system uses by looking at the ID prefix in your /etc/shadow file:
$1$: MD5 (Avoid this)$6$: SHA-512 (Standard, but getting faster)$y$: yescrypt (Recommended for modern, high-security systems)
Entropy and Complexity
Even the strongest algorithm cannot protect a "weak" password. Entropy is the measure of unpredictability in a password. A password like password123 has very low entropy because it is predictable; a computer can guess it instantly regardless of how "slow" the hashing algorithm is.
To ensure system security, you must enforce high-entropy requirements—forcing users to combine character sets, avoid dictionary words, and maintain sufficient length. High entropy ensures that even if an attacker attempts a "brute-force" search, the search space is mathematically so massive that it would take longer than the age of the universe to exhaust.
In Linux, you balance security by pairing a slow, modern hashing algorithm with strict system policies that demand high-entropy input from users.
Key Takeaway: Modern Linux security relies on using computationally expensive algorithms like yescrypt to slow down attackers, combined with high-entropy password requirements to ensure the search space is too vast to brute-force.