authenticating against /etc/passwd

[dave]

Hello,
I've got a php script that is trying to authenticate a user against a
rh9 /etc/passwd file. The passwd file has permissions of 444 but when i try
to log in i am being redirected to my error page with the error invalid
username or password. I have confirmed that the user in question can
manually log in to the system so i know the credentials are correct. My only
idea has been that the password uses special symbols a dollar sign for one
and i thought escaping them with '' would work, this has not. Suggestions
welcome.
Thanks.
Dave.

[Daniel Tryba]

dave <dm*******@woh.rr.com> wrote:

I've got a php script that is trying to authenticate a user against a
rh9 /etc/passwd file.

??? It's been quite some years since all Linux distributions switched
to shadow passwords. Useless you messed around /etc/passwd shouldn't
contain passwords, eg:
root:x:0:0:root:/root:/bin/sash
--

Daniel Tryba

> rh9 /etc/passwd file. The passwd file has permissions of 444 but when i try

As mentioned above, your passwords will not be in the /etc/passwd file.
They are in the shadow file.

You should look into PAM authentication

____________________________________
Wil Moore III, MCP | Integrations Specialist | Senior Consultant
Business | Personal

[Mad Max]

Try generating the MD5 hash value of the password and comparing that
to the value stored in the passwd file..as far as i know linux
generates MD5 hashes and stores them instead of the real password...
that is why passwords in linux are irrecoverable... u can use the Md5
function in PHP to do that..

bye
Arvind

"dave" <dm*******@woh.rr.com> wrote in message news:<CD**************@fe1.columbus.rr.com>...

Hello,
I've got a php script that is trying to authenticate a user against a
rh9 /etc/passwd file. The passwd file has permissions of 444 but when i try
to log in i am being redirected to my error page with the error invalid
username or password. I have confirmed that the user in question can
manually log in to the system so i know the credentials are correct. My only
idea has been that the password uses special symbols a dollar sign for one
and i thought escaping them with '' would work, this has not. Suggestions
welcome.
Thanks.
Dave.

[Phil Roberts]

With total disregard for any kind of safety measures
<la*******@hotmail.com> leapt forth and uttered:

Please do not post in HTML format in future.

--
There is no signature.....

[Phil Roberts]

With total disregard for any kind of safety measures
as****@uncc.edu (Mad Max) leapt forth and uttered:

Try generating the MD5 hash value of the password and comparing
that to the value stored in the passwd file..as far as i know
linux generates MD5 hashes and stores them instead of the real
password... that is why passwords in linux are irrecoverable...
u can use the Md5 function in PHP to do that..

Actually I believe the passwords in passwd are encrypted using
crypt(), not md5()

Heres something the O.P. may wish to look into:
http://pear.php.net/package/File_Passwd

--
There is no signature.....