/etc/shadow in old format, where is salt stored?

Question

In /etc/shadow I have entries such as admin:YtChlvAGYzva2:16318:0:99999:7:::. I know the original password and would like to generate the same hash somehow. However, running openssl passwd -crypt password gives me different results every time I run it. I assume salt is involved, so where can I find the salt used to create the original hash?

Edit: I got the original hash using the following command:

openssl passwd -crypt -salt Yu password

Answer 1

The salt and the encrypted password are both mashed into the string YtChlvAGYzva2.

From the Shadow Password Howto:

When a user picks or is assigned a password, it is encoded with a randomly generated value called the salt. This means that any particular password could be stored in 4096 different ways. The salt value is then stored with the encoded password.

When a user logs in and supplies a password, the salt is first retrieved from the stored encoded password.

The longer password strings you see with modern systems separate the hash using $. But for the older systems, it was just mashed in (Wikipedia):

Earlier versions of Unix used a password file (/etc/passwd) to store the hashes of salted passwords (passwords prefixed with two-character random salts). In these older versions of Unix, the salt was also stored in the passwd file (as cleartext) together with the hash of the salted password.

In your example, I believe that the salt is "Yt" and the encrypted password is "ChlvAGYzva2". It's literally the first two characters of the string.