|
|
Sponsored Content
Top Forums
Programming
root privileges
Post 94370 by Perderabo on Thursday 29th of December 2005 09:33:34 PM
12-29-2005
Take a look at the code I posted. I sidestepped the issue with:
#define ENCRYPT "O26nQUAUM2vLA"
but the su program obtains the encrypted string from somewhere. Exactly where varies. It might be /etc/passwd. It might be /etc/shadow. It might be NIS or NIS+. There are other options too. All that matters is that the local su program knows where to obtain the encrypted string. And it gets the plaintext candidate password interactively from the user. Then it uses the code I posted to compare the two. (Or something pretty similiar. )
I think that what is bothering you is a missing piece of data. Usually we think of something roughly like this: PLAINTEXT + KEY = CHIPHERTEXT
Actually the cleartext password is the key and the encrypted password is the chiphertext. So where is the plaintext? It is a well known constant stored in crypt routine. This is why the Unix password is locked at 8 characters in length. It is easy to increase the length of the cleartext but a new algorithm is needed to the size of the key. They had to do it this way. If the key was stored in the source code, everyone (who cared) would know it and anyone could use it to decrypt the password. But there is no way to take the plaintext and the chiphertext and recover the key. They wanted the password to be secure even if you had the source code for crypt() and the encrypted password. Even today, all these decades later, brute force is still the only viable attack. The weakness of the Unix password scheme is that today brute force is feasible against an 8 character password. crypt() is actually an amazing piece of work.
The salt is just basicly one of 4096 random strings added to password. So if my password is "bullfrog" the encrypted password will be one of 4096 results. This makes it harder to recognize that two accounts have the same password. And if you try to build a database of possible encrypted strings, your job is now 4096 times harder.
The Unix password scheme is described in the paper Password Security: A Case History by Robert Morris and Ken Thompson. This is not the RTM who wrote the Morris Worm; this is his father. I found a copy in the UNIX System Manager's Manual which was part of the 4.3 BSD documents dated April, 1986. But I think that paper is circa 1975 or so. It is a very early paper. BTW, Morris and Thompson also wrote the crypt() routine itself.
[EDIT]
I found that paper at the ACM website: Link
Published in 1979 I see... oh well, I had the right decade!
#define ENCRYPT "O26nQUAUM2vLA"
but the su program obtains the encrypted string from somewhere. Exactly where varies. It might be /etc/passwd. It might be /etc/shadow. It might be NIS or NIS+. There are other options too. All that matters is that the local su program knows where to obtain the encrypted string. And it gets the plaintext candidate password interactively from the user. Then it uses the code I posted to compare the two. (Or something pretty similiar. )
I think that what is bothering you is a missing piece of data. Usually we think of something roughly like this: PLAINTEXT + KEY = CHIPHERTEXT
Actually the cleartext password is the key and the encrypted password is the chiphertext. So where is the plaintext? It is a well known constant stored in crypt routine. This is why the Unix password is locked at 8 characters in length. It is easy to increase the length of the cleartext but a new algorithm is needed to the size of the key. They had to do it this way. If the key was stored in the source code, everyone (who cared) would know it and anyone could use it to decrypt the password. But there is no way to take the plaintext and the chiphertext and recover the key. They wanted the password to be secure even if you had the source code for crypt() and the encrypted password. Even today, all these decades later, brute force is still the only viable attack. The weakness of the Unix password scheme is that today brute force is feasible against an 8 character password. crypt() is actually an amazing piece of work.
The salt is just basicly one of 4096 random strings added to password. So if my password is "bullfrog" the encrypted password will be one of 4096 results. This makes it harder to recognize that two accounts have the same password. And if you try to build a database of possible encrypted strings, your job is now 4096 times harder.
The Unix password scheme is described in the paper Password Security: A Case History by Robert Morris and Ken Thompson. This is not the RTM who wrote the Morris Worm; this is his father. I found a copy in the UNIX System Manager's Manual which was part of the 4.3 BSD documents dated April, 1986. But I think that paper is circa 1975 or so. It is a very early paper. BTW, Morris and Thompson also wrote the crypt() routine itself.
[EDIT]
I found that paper at the ACM website: Link
Published in 1979 I see... oh well, I had the right decade!
Last edited by Perderabo; 12-29-2005 at 10:44 PM.. Reason: Add link to paper
|
|
10 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
Hi guys...
how can a root assign a user all or most of the root privileges?
is sudoer comand enough 4 this?
thx alot.. (2 Replies)
Discussion started by: blue_7
2 Replies
2. Solaris
Hi, I've just managed to install openssh in my home directory on a server I have access to by using --prefix=$HOME/local after ./configure. Another thing I was having trouble with without root access was privilege separation, so I disabled that in my sshd_config. However, when I run... (10 Replies)
Discussion started by: sayeo
10 Replies
3. UNIX for Dummies Questions & Answers
Hello,
As admin with root rights, to execute any command from another user without password-ask, I do : su - <user> -c "<cmd>"
But how can I do to give the same rights to another physical user without using root user ? :confused:
I've try to create another user "toor" with the same primary... (4 Replies)
Discussion started by: madmat
4 Replies
4. Linux
Hi,
Is it possible to grant root privileges to an ordinary user?
Other than 'sudo', is there some way under Users/Groups configuration?
I want ordinary user to be able to mount, umount and use command mt.
/Brendan (4 Replies)
Discussion started by: brendan76
4 Replies
5. Shell Programming and Scripting
I have written a small web server in Python, and now I would like to run it on port 80, but in order to be able to bind to a port below 1024 I need to have root privileges. I don't want to run the server as root, though. How can I bind to port 80 as root and then drop root privileges?
Thankful... (0 Replies)
Discussion started by: Ilja
0 Replies
6. Shell Programming and Scripting
My English is no very good.
I must make a bash scripting sh create like a backdoor, and when execute the script a user without privileges convert in super user or root, whithout introducing the password.
In Spanish:
Crear un script que sirva como puerta trasera al sistema, de manera que al... (1 Reply)
Discussion started by: kitievbr
1 Replies
7. Solaris
Hello
I am a new (and only) administrator of a Solaris 10 environment. The previous admin gave me a use (say user123) that is supposed to have administrative privileges.
Now the problem is, the user does not have this privilege! Here is what i tried so far:
$ id
uid=109(user123) gid=1(other)... (3 Replies)
Discussion started by: abohmeed
3 Replies
8. HP-UX
hi,
i am new in hp ux and i must create a user with root privileges and so i disable ssh connection from root login.
thanks.. (6 Replies)
Discussion started by: eliste
6 Replies
9. UNIX for Dummies Questions & Answers
I had a question in my test which asked where suppose user B has a program with 's' bit set. Can user A run this program and gain root privileges in any way?
I suppose not as the suid program run with privileges of owner and this program will run with B's privileges and not root. (1 Reply)
Discussion started by: syncmaster
1 Replies
10. Infrastructure Monitoring
Hi guys,
I am currently managing an application running on around 150 servers.
I only have application usage rights on those servers and do not have any root privileges.
I have an external node that can connect to those servers and I have root privileges on that one box.
I want to setup... (2 Replies)
Discussion started by: Junaid Subhani
2 Replies
LEARN ABOUT MINIX
pwdauth
PWDAUTH() PWDAUTH() NAME
pwdauth - password authentication program SYNOPSIS
/usr/lib/pwdauth DESCRIPTION
Pwdauth is a program that is used by the crypt(3) function to do the hard work. It is a setuid root utility so that it is able to read the shadow password file. Pwdauth expects on standard input two null terminated strings, the password typed by the user, and the salt. That is, the two arguments of the crypt function. The input read in a single read call must be 1024 characters or less including the nulls. Pwdauth takes one of two actions depending on the salt. If the salt has the form "##user" then the user is used to index the shadow password file to obtain the encrypted password. The input password is encrypted with the one-way encryption function contained within pwdauth and compared to the encrypted password from the shadow password file. If equal then pwdauth returns the string "##user" with exit code 0, otherwise exit code 2 to signal failure. The string "##user" is also returned if both the shadow password and the input password are null strings to allow a password-less login. If the salt is not of the form "##user" then the password is encrypted and the result of the encryption is returned. If salt and password are null strings then a null string is returned. The return value is written to standard output as a null terminated string of 1024 characters or less including the null. The exit code is 1 on any error. SEE ALSO
crypt(3), passwd(5). NOTES
A password must be checked like in this example: pw_ok = (strcmp(crypt(key, pw->pw_passwd), pw->pw_passwd) == 0); The second argument of crypt must be the entire encrypted password and not just the two character salt. AUTHOR
Kees J. Bot (kjb@cs.vu.nl) PWDAUTH()