By using this site, you agree to our updated Privacy Policy and our Terms of Use. Manage your Cookies Settings.
429,083 Members | 1,957 Online
Bytes IT Community
+ Ask a Question
Need help? Post your question and get tips & solutions from a community of 429,083 IT Pros & Developers. It's quick & easy.

Linux System Users Login/Password?

P: n/a
Hi,

Has anyone managed to code anything that will verify the username and
password of a user against the /etc/shadow file?

I need to authenticate users based on their local system accounts, but
unfortunately need to do this without recompiling PHP or Apache with custom
modules.

So far I've managed to pull all of the shadow password strings out and into
a database, but is there any way of 'matching' the encrypted strings if you
are given the plain text version, like with md5?

Thanks in advance,
Vince.
Jun 13 '06 #1
Share this Question
Share on Google+
5 Replies


P: n/a
Vincent Pirez wrote:
Hi,

Has anyone managed to code anything that will verify the username and
password of a user against the /etc/shadow file?

I need to authenticate users based on their local system accounts, but
unfortunately need to do this without recompiling PHP or Apache with custom
modules.

So far I've managed to pull all of the shadow password strings out and into
a database, but is there any way of 'matching' the encrypted strings if you
are given the plain text version, like with md5?

Thanks in advance,
Vince.

PHP has a function named 'crypt' that will encrypt strings in the same
way the password is encrypted into the password file. It takes a
password string and a salt string.

The encryption algorithm may vary but is typically either a two
character salt (CRYPT_STD_DES) or an MD5 salt (CRYPT_MD5). The MD5
encryptions are guaranteed to start with a '$' sign.

So, for example, let's say your shadow entry is:
web:$2$Hlpmlp9i$5VnapGyOuIzJFkPcrvE7a.:13007:0:999 99:7:::

This is a MD5 encrypted password.

if( crypt($password, $salt) == '$2$Hlpmlp9i$5VnapGyOuIzJFkPcrvE7a.')) {
// password is correct
}

Do you really want to pull all the shadow entries into a database? Why
not read the file directly and explode() the entries? It seems to me
that you will have synchronization issues the other way.

-david-

Jun 13 '06 #2

P: n/a

"David Haynes" <da***********@sympatico.ca> wrote in message
news:2h*******************@fe06.usenetserver.com.. .
PHP has a function named 'crypt' that will encrypt strings in the same way
the password is encrypted into the password file. It takes a password
string and a salt string.

The encryption algorithm may vary but is typically either a two character
salt (CRYPT_STD_DES) or an MD5 salt (CRYPT_MD5). The MD5 encryptions are
guaranteed to start with a '$' sign.

So, for example, let's say your shadow entry is:
web:$2$Hlpmlp9i$5VnapGyOuIzJFkPcrvE7a.:13007:0:999 99:7:::

This is a MD5 encrypted password.

if( crypt($password, $salt) == '$2$Hlpmlp9i$5VnapGyOuIzJFkPcrvE7a.')) {
// password is correct
}

Do you really want to pull all the shadow entries into a database? Why not
read the file directly and explode() the entries? It seems to me that you
will have synchronization issues the other way.

-david-


Hi David,

Thanks for the great response. But how do I determine the matching salt?

Thanks,
Vince.
Jun 13 '06 #3

P: n/a
Vincent Pirez wrote:
"David Haynes" <da***********@sympatico.ca> wrote in message
news:2h*******************@fe06.usenetserver.com.. .
PHP has a function named 'crypt' that will encrypt strings in the same way
the password is encrypted into the password file. It takes a password
string and a salt string.

The encryption algorithm may vary but is typically either a two character
salt (CRYPT_STD_DES) or an MD5 salt (CRYPT_MD5). The MD5 encryptions are
guaranteed to start with a '$' sign.

So, for example, let's say your shadow entry is:
web:$2$Hlpmlp9i$5VnapGyOuIzJFkPcrvE7a.:13007:0:999 99:7:::

This is a MD5 encrypted password.

if( crypt($password, $salt) == '$2$Hlpmlp9i$5VnapGyOuIzJFkPcrvE7a.')) {
// password is correct
}

Do you really want to pull all the shadow entries into a database? Why not
read the file directly and explode() the entries? It seems to me that you
will have synchronization issues the other way.

-david-


Hi David,

Thanks for the great response. But how do I determine the matching salt?

Thanks,
Vince.

The short answer is that the salt of the encrypted password in the
shadow file is used.

A sample program:
<?php
$shadow_pw = '$1$Hlpmlp9i$5VnapGyOuIzJFkPcrvE7a.';
$my_pw = array('foofoofoo', 'letmein');

foreach( $my_pw as $pw ) {
if( crypt($pw, $shadow_pw) == $shadow_pw ) {
echo "The password $pw is good\n");
} else {
echo "The password $pw is bad\n");
}
}
?>

-david-

Jun 13 '06 #4

P: n/a

"David Haynes" <da***********@sympatico.ca> wrote in message
news:gY******************@fe46.usenetserver.com...

The short answer is that the salt of the encrypted password in the shadow
file is used.

A sample program:
<?php
$shadow_pw = '$1$Hlpmlp9i$5VnapGyOuIzJFkPcrvE7a.';
$my_pw = array('foofoofoo', 'letmein');

foreach( $my_pw as $pw ) {
if( crypt($pw, $shadow_pw) == $shadow_pw ) {
echo "The password $pw is good\n");
} else {
echo "The password $pw is bad\n");
}
}
?>


David,

Ahhh i get it now, by crypt()'ing the password against the shadow password
it somehow verifies.....I'm curious how this works, but don't need an
explanation unless anyone's willing to offer one?

Fact of the matter is it works, and is verifying nicely - many thanks for
your help David :)

Vince.
Jun 13 '06 #5

P: n/a
Vincent Pirez wrote:
David,

Ahhh i get it now, by crypt()'ing the password against the shadow password
it somehow verifies.....I'm curious how this works, but don't need an
explanation unless anyone's willing to offer one?
The first 'n' characters of any encrypted password is the salt used to
create the password. By supplying an encrypted password as the salt, you
are essentially providing the salt.
Fact of the matter is it works, and is verifying nicely - many thanks for
your help David :)


Cool! Glad its working out for you.

-david-

Jun 13 '06 #6

This discussion thread is closed

Replies have been disabled for this discussion.