With shadow >= 4.14.0, Arch Linux’s default password hashing algorithm changed from SHA512 to yescrypt [1].
Furthermore, the umask [2] settings are now configured in /etc/login.defs instead of /etc/profile.
This should not require any manual intervention.
Reasons for Yescrypt
The password-based key derivation function (KDF) and password hashing scheme yescrypt has been chosen due to its adoption (readily available in libxcrypt, which is used by pam [3]) and its stronger resilience towards password cracking attempts over SHA512.
Although the winner of the Password Hashing Competition [4] has been argon2, this even more resilient algorithm is not yet available in libxcrypt [5][6].
Configuring yescrypt
The YESCRYPT_COST_FACTOR setting in /etc/login.defs is currently without effect, until pam implements reading its value [7]. If a YESCRYPT_COST_FACTOR higher (or lower) than the default (5) is needed, it can be set using the rounds option of the pam_unix [8] module (i.e. in /etc/pam.d/system-auth).
General list of changes
yescrypt is used as default password hashing algorithm, instead of SHA512
pam honors the chosen ENCRYPT_METHOD in /etc/login.defs and does not override the chosen method anymore
changes in the filesystem (>= 2023.09.18) and pambase (>= 20230918) packages ensure, that umask is set centrally in /etc/login.defs instead of /etc/profile
AUR (Arch User Repository) packages are neither supported by Arch nor Manjaro. Posts about them in Announcement topics are off-topic and will be flagged, moved or removed without warning.
Which is a Bad Idea™, because this means that there can now be only one umask setting for all user accounts. Before, one could distinguish between the root account’s umask (which needs to be 022) and that of unprivileged users. The following is from my own /etc/profile.
if [ ${UID} -lt 1000 ]
then
umask 022
else
umask 077
fi
/etc/login.defs has only one umask setting…
# Default initial "umask" value used by login(1) on non-PAM enabled systems.
# Default "umask" value for pam_umask(8) on PAM enabled systems.
# UMASK is also used by useradd(8) and newusers(8) to set the mode for new
# home directories if HOME_MODE is not set.
# 022 is the default value, but 027, or even 077, could be considered
# for increased privacy. There is no One True Answer here: each sysadmin
# must make up their mind.
UMASK 077
2 days ago, I had created a new user via KDE Manage Users and changed its pw, it still uses SHA512 by default.
Today I tried to create another new user with useradd and passwd in CLI . Ah yes, It uses yescrypt.
It looks like this “KDE Manage Users” does not use passwd.
I change root’s pw and my account’s pw in CLI, do not use “KDE Manage Users”. Thank you.
Anyway when I ran my update, today I did it through Octopi (normally I don’t do it that way, mostly use pacman cli) and it automatically upgraded all of those.
Eh lol, indeed. I guess it’s an arch thing now. 5 is more than none though, so it’s better now. Next week 6 confirmed! But someone should still ask to be sure.
AUR (Arch User Repository) packages are neither supported by Arch nor Manjaro. Posts about them in Announcement topics are off-topic and will be flagged, moved or removed without warning.
This is not a Plasma 6 discussion thread. Settle down, nothing actually happened. 