The UNIX and Linux Forums  

Go Back   The UNIX and Linux Forums > OS Specific Forums > Linux
Google UNIX.COM


Linux RedHat, Ubuntu, SUSE, Fedora, Debian, Mandriva, Slackware, Gentoo linux, PCLinuxOS. All Linux questions here!

More UNIX and Linux Forum Topics You Might Find Helpful
Thread Thread Starter Forum Replies Last Post
I want to append password in /etc/shadow file modgil Shell Programming and Scripting 5 03-21-2006 08:08 PM
how can i send via SFTP information with my password encrypted? irasela SUN Solaris 1 01-26-2006 05:29 AM
Change password by pushing encrypted password to systems benq70 UNIX for Dummies Questions & Answers 1 09-02-2005 06:08 AM
remove shadow password gizaa UNIX for Dummies Questions & Answers 2 08-03-2004 04:30 PM
netrc file encrypted password ggowrish UNIX for Advanced & Expert Users 2 06-17-2004 02:15 AM

Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 03-11-2008
Registered User
 

Join Date: Apr 2002
Location: Dallas, TX
Posts: 53
Interpreting the encrypted shadow password?

We are currently using a script to copy the same encrypted password between our HP-UX and Solaris servers editing the trusted and shadow files directly. The encrypted password is only 13 characters long on both servers and decrypts the same way. Is there a way to copy this same string to Linux servers?

The encrypted password in the shadow file on one of our Linux servers looks like this:
1$9EmV.jZO$YyfdtPT11aP3hE.jqX7Ve0

I've read the crypt 3 man page but I am not sure how to intrepret it. Any idea if its possible to replace 13 characters in this string to decrypt the same password?
Reply With Quote
Forum Sponsor
  #2 (permalink)  
Old 03-11-2008
...@...
 

Join Date: Feb 2004
Location: NM
Posts: 3,419
You can just go over to a Linux box, set the user's password, and see the result in the shadow file.

I do not know if encryption is identical on those three Unixes.

Your other choice: run some sort of script to update passwords remotely.
Reply With Quote
  #3 (permalink)  
Old 03-12-2008
Registered User
 

Join Date: Apr 2002
Location: Dallas, TX
Posts: 53
Thanks Jim for the reply. The problem is that the encrypted password string on HP-UX and Solaris is 13 characters long. On Linux it is 34 characters long. I'm not sure if there are special meanings in these 34 characters or if it is just a 26 character salt or what. It would be nice if I could somehow figure out how to use the 13 character string somewhere in the Linux encryption.

We currently have an expect script to change passwords but it is painfully slow compared to the script I wrote for HP and Sun. I wanted to incorporate Linux into this script but cannot figure out how to do it.
Reply With Quote
  #4 (permalink)  
Old 03-12-2008
Registered User
 

Join Date: Dec 2007
Location: Virginia, USA.
Posts: 223
The simple answer is to identify the most secure and compatible hashing algorithm supported by all three platforms, settle on this and alter the systems configurations to honor this algorithm and use it for future password generation. Then a method to generate the passwords for each user using the same salt on all three platforms could be devised along with a way to generate the users passwd/shadow entries and then a method to add these to password/shadow files on target systems.

All of this would be simplified to a great degree if central authentication was in use, ala LDAP or NIS, unless I'm misunderstanding. Otherwise it's a poor man's directory service
Reply With Quote
  #5 (permalink)  
Old 03-12-2008
Registered User
 

Join Date: Apr 2002
Location: Dallas, TX
Posts: 53
We use Vintella for central authorization but do not use it for root or application IDs. In an enterprise this big changing any hashing algorithms for passwords is not feasible.

It sounds like I'm SOL. I can create a different script to handle just the Linux servers but was really hoping to be able to do it in one script.
Reply With Quote
  #6 (permalink)  
Old 03-12-2008
Registered User
 

Join Date: Dec 2007
Location: Virginia, USA.
Posts: 223
.For your root and appllication passwords you can always use expect or automated ssh to batch process passwd changes driving the native platforms passwd. I've used expect for this in the past.

Code:
proc manualChange {} {
global prompt spawn_id timeout
                         expect  {
				  -i $spawn_id -re $prompt {
					             send_user "Logged in to host: $name as $username\n"
					             send "passwd\r\n"
					             expect -i $spawn_id -re ".*asswor.*" {
                                                               set new [getInput "Password change for $username on $name: "]


								send "$new\r\n"
								expect -i $spawn_id -re "\[Rr\]e.*asswor.*" {
								          send "$new\r\n"
								          expect -i $spawn_id  -re "$prompt" {										                                                  send_user "Password changed successfully for $name\n"
										                             }
										      }
							     }
					        }
                         timeout {send_user "Timed out for spawn_id: $spawn_id\n"}
			 eof {send_user "Abnormal termination for spawn_id: $spawn_id"}
			 }
}

if {[llength $argv] < 2} {puts "Please provide:\n 1. username\n 2. list of hosts" ;  exit}
set username [lindex $argv 0]
set hostlist [lrange $argv 1 [llength $argv]]
##main()
         set prompt "[lindex $argv 0]@.*|.*[lindex $argv 0].*>|.*[lindex $argv 0].*#"
         foreach name $hostlist {
	                         if {![catch {eval spawn $loginprog $username@$name} err_spawn]} {
				      puts "Connecting to $name..."
				      expect  {
				          
					      -re $prompt {
					                     send_user "Logged in to host: $name as $username\n"
							     send "passwd\r\n"
							     expect -i $spawn_id -re ".*asswor.*" {
                                                                       set new [getInput "Password change for $username on $name: "]
								       send "$new\r\n"
								       expect -i $spawn_id -re "\[Rr\]e.*asswor.*" {
										            send "$new\r\n"
										            expect -i $spawn_id  -re "$prompt" {
										                                               send_user "Password changed successfully for $name\n"
										                             }
										      }
							     }
					        }		     			
					        -re $pwprompt {
						              send_user "Log in manually and then press ^p to change password\n"
						              interact {
							                 "^P" {manualChange}
							      }
					        }		      		   		                                   
						timeout {send_user "Timed out waiting on $name\n"}
						eof {send_user "Abnormal exit for connect() to host: $name\n"}
				       }													                             
				     } else {
				        puts "ERROR: Connecting to host: $name = $err_spawn"
				     }	  
	   }
Using ssh-agent and keys this is a quick way to change passwords and also allows you to catch hosts without keys, etc...
HTH.
Reply With Quote
Google UNIX.COM
Reply

Tags
linux, solaris

Thread Tools
Display Modes




All times are GMT -7. The time now is 03:05 PM.


Powered by: vBulletin, Copyright ©2000 - 2006, Jelsoft Enterprises Limited.
The UNIX and Linux Forums Content Copyright ©1993-2008 The CEP Blog All Rights Reserved -Ad Management by RedTyger Visit The Global Fact Book

Content Relevant URLs by vBSEO 3.2.0