private String generateCryptSalt() {
        val cryptSalt = new StringBuilder();
        if ("1".equals(this.encodingAlgorithm) || "MD5".equalsIgnoreCase(this.encodingAlgorithm)) {
            cryptSalt.append("$1$");
            LOGGER.debug("Encoding with MD5 algorithm");
        } else if ("5".equals(this.encodingAlgorithm) || "SHA-256".equalsIgnoreCase(this.encodingAlgorithm)) {
            cryptSalt.append("$5$rounds=").append(this.strength).append('$');
            LOGGER.debug("Encoding with SHA-256 algorithm and [{}] rounds", this.strength);
        } else if ("6".equals(this.encodingAlgorithm) || "SHA-512".equalsIgnoreCase(this.encodingAlgorithm)) {
            cryptSalt.append("$6$rounds=").append(this.strength).append('$');
            LOGGER.debug("Encoding with SHA-512 algorithm and [{}] rounds", this.strength);
        } else {
            cryptSalt.append(this.encodingAlgorithm);
            LOGGER.debug("Encoding with DES UnixCrypt algorithm as no indicator for another algorithm was found.");
        }

        if (StringUtils.isBlank(this.secret)) {
            LOGGER.debug("No secret was found. Generating a salt with length [{}]", SALT_LENGTH);
            val keygen = new HexRandomStringGenerator(SALT_LENGTH);
            this.secret = keygen.getNewString();
        } else {
            LOGGER.trace("The provided secret is used as a salt");
        }
        cryptSalt.append(this.secret);
        return cryptSalt.toString();
    }
Special note on DES UnixCrypt:
In DES UnixCrypt, so first two characters of the encoded password are the salt.
<p>
When you change your password, the {@code /bin/passwd} program selects a salt based on the time of day.
The salt is converted into a two-character string and is stored in the {@code /etc/passwd} file along with the
encrypted {@code "password."[10]} In this manner, when you type your password at login time, the same salt is used again.
UNIX stores the salt as the first two characters of the encrypted password.

@param rawPassword     the raw password as it was provided
@param encodedPassword the encoded password.
@return true/false
core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/crypto/GlibcCryptPasswordEncoder.java