Use and complete the template provided. The entire template must be completed. If you don't, your post may be deleted!
1. The problem statement, all variables and given/known data:
Hello guys
I am about to write a script that is based on "The Linux Administration Handbook" The exercise is as follows:
Write a shell script to help monitor the health of the /etc/passwd file.
Find entries that have UID0
Find entries that have no password (needs /etc/shadow)
Find any sets of entries that have duplicate UID's
Find entries that have duplicate login names
find entries that have no expiration date (needs /etc/shadow)
I finished point 1,3, and 4. What I am not able to figure out is how to access the shadow file without being root. I thought maybe by exec su | sh, and then access the file. But the user shouldn't have to interact with the script. Here is what I have so far
Any ideas, hints, advice etc. is greatly appreciated. Thank you.
-Daniel
2. Relevant commands, code, scripts, algorithms:
reg expr., flow control, branch statements, iteration through file, mechanism to provide shadow file check without user interference.
3. The attempts at a solution (include all code and scripts):
Code:
#!/usr/bin/sh
#
# SCRIPT: lab5
# AUTHOR:
# DATE: 8/15/2012
# REV: 1.0A
# PLATFORM: Linux
# PURPOSE: Maintain Health of the /etc/passwd file by checking for
# duplicate UID's, root ID, duplicate login names,
# expiration date, entries with no password.
#
#
# REV LIST:
# DATE: 8/16/2012
# BY:
# MDIFICATION: add awk for duplicate UID and login name check.
#
#
#
###############################################################################
##################### DEFINE FILES AND VARIABLES HERE #########################
###############################################################################
# NO VARIABLES
###############################################################################
######################### DEFINE FUNCTIONS HERE ###############################
###############################################################################
# NO FUNCTIONS
###############################################################################
######################### BEGINNING OF MAIN ###################################
###############################################################################
# This line checks for the root ID. It notifies the user if the root ID
# exists or not.
echo "Check for root uid..."
awk -F: '$1 = ~/root/ {print "Found Root ID"} ' /etc/passwd
# Check for duplicate UID by reading the records into an awk array
# and compare the predecessor with the successor. If the comparison
# result is greater as 1 print the duplicate value.
echo "Check for duplicate UID's..."
awk -F: 'uname[$3]++ && uname[$3]>1 {print "duplicate user:", $1} ' /etc/passwd
echo "Duplicate UID check done"
# Check for duplicate UID by reading the records into an awk array
# and compare the predecessor with the successor. If the comparison
# result is greater as 1 print the duplicate value.
echo "Check for duplicate user names..."
awk -F: 'uid[$3]++ && uid[$3]>1 {print "duplicate uid:", $3}' /etc/passwd
echo "Duplicate user name check done."
echo "Check for passwords..."
# I am not sure about that one !
#`exec su | sh | awk -F: '$2 ~/$\d$/ {print "User $1 has password}' /etc/shadow | exit`
exit 0
# End of Script
4. Complete Name of School (University), City (State), Country, Name of Professor, and Course Number (Link to Course):
University of Chicago, Chicago (Illinois), Prof. Anthony Packart, CMSC 23000
Note: Without school/professor/course information, you will be banned if you post here! You must complete the entire template (not just parts of it).
My 2 cents:
-About root: its not because your login name is root that you are...
- Finding entries without password, can be more tricky than you imagine: Some UID e.g. bin, lp have no... what are you to look at? all or true users without ?
Quote:
mechanism to provide shadow file check without user interference.
how do you understand the sentance?
Is there a reason why you doing all using only awk? e.g.
looking for root accounts: grep :0: /etc/passwd or grep :0:0: /etc/passwd...
My 2 cents:
-About root: its not because your login name is root that you are...
Maybe you should save your 2 cents, since I have no idea what you mean with this statement.
Quote:
- Finding entries without password, can be more tricky than you imagine:
Passwords are usually encrypted using MD5, so passwords in shadow would be $\d$, that is all I need.
Quote:
Some UID e.g. bin, lp have no... what are you to look at? all or true users without ?
how do you understand the sentance?
What are you trying to say here?
Quote:
Is there a reason why you doing all using only awk? e.g.
looking for root accounts: grep :0: /etc/passwd or grep :0:0: /etc/passwd...
I don't want grep to print the line encountered with my criteria and does it really matter what I use? I use awk since it is convenient for me to use. I wonder why I have to discuss procedures and tools here rather than the problem itslef. A hint on how to ACCESS THE SHADOW FILE FOR REG EXPR COMPARISON WITHOUT ROOT PRIVILEGES is asked here.
Maybe you should save your 2 cents, since I have no idea what you mean with this statement.
Passwords are usually encrypted using MD5, so passwords in shadow would be $\d$, that is all I need.
What are you trying to say here?
I don't want grep to print the line encountered with my criteria and does it really matter what I use? I use awk since it is convenient for me to use. I wonder why I have to discuss procedures and tools here rather than the problem itslef. A hint on how to ACCESS THE SHADOW FILE FOR REG EXPR COMPARISON WITHOUT ROOT PRIVILEGES is asked here.
You seem to be expecting the /etc/passwd entry for root to be something like:
Code:
root:*:0:0:System Administrator:/var/root:/bin/sh
with root as the user name, but what vbe was saying is that an entry like:
has exactly the same privileges as root in the entry you're looking for, but your script won't notice it.
Some accounts are set up so that they can never be used to login. They may have an entry in the password field in the shadow file like NOPASSWD, NOLOGIN, or any other string that can never match an encrypted password. From the statement of the problem, it isn't clear whether you should be looking for an MD5 password or just looking for a field that is not empty. This is intended to answer your 2nd and 3rd questions.
You can use grep -c or grep with stdout redirected and check the exit status to determine whether or not at least one line matches your search pattern. When you post to a forum like this, we assume that you're asking for suggestions on how to do the job you're trying to do. If what you are using is grossly inefficient or overly complex, why don't you want to know about alternative methods to accomplish what you're trying to do?
There is no way to ACCESS THE SHADOW FILE FOR REG EXPR COMPARISON WITHOUT ROOT PRIVILEGES. Or, if there is, your system's security mechanisms have been disabled and any user that can access your system can hack it to do anything they want. It sounds like your assignment is to determine a way to get the privileges needed to access that file. Some possibilities could include using a setuid root shell script (which you would have to be root to setup), su to root before running your script (which would require you to know root's password and find secure way to enter it from a shell script), or sudo. (Note also that some systems use an open directory or other authentication system and don't even have a traditional shadow file.) I don't think anybody here is going to give you a script that will do any of these, but this may give you some ideas to investigate. Also note that ways to do this may vary considerably from system to system.
I could check for UID 0, that might yield the root account in a variety of circumstances such as root and super as you described. I certainly understand the security threat this script might produce, I even don't understand why this book even thinks that this might be a good exercise. But I think the safest way is to execute this script while the user has root privileges already. I tried running the
Quote:
Find entries that have UID0
Find any sets of entries that have duplicate UID's
Find entries that have duplicate login names
as a normal user and then ask for root password in order to to check the passwords and expiration values. So far I couldn't find a way that this script might continue automatically after the su password has been provided. But I think running it as root right from the beginning might be the way to go and is less overhead.
I could check for UID 0, that might yield the root account in a variety of circumstances such as root and super as you described. I certainly understand the security threat this script might produce, I even don't understand why this book even thinks that this might be a good exercise. But I think the safest way is to execute this script while the user has root privileges already. I tried running the
Code:
Find entries that have UID0
Find any sets of entries that have duplicate UID's
Find entries that have duplicate login names
as a normal user and then ask for root password in order to to check the passwords and expiration values. So far I couldn't find a way that this script might continue automatically after the su password has been provided. But I think running it as root right from the beginning might be the way to go and is less overhead.
which isn't correct either since it will not only find root but also find cvsroot on my system (and only one of those has UID 0). (You need to use anchors in your matching pattern if you're looking for root, and you need to match something on another field if you're looking for UID 0.)
If you look at your su(1M) or su(1) man page, you should find that you can use it to run another script if the root authorization succeeds. I don't see anything in you assignment that says that the entire script has to be in a single file. (I'm not suggesting that you use su, but your argument for not using it shows that you don't understand how su works.) I agree that being root when you run the script is probably a good idea. But any shell script that is to be run by root needs to do a LOT of extra security checks to be sure that a hacker hasn't set up a $PATH that will cause your script to run alternative utilities to capture root privileges when an unsuspecting administrator runs an insecure script. Your script doesn't take any steps to prevent these types of attacks. (Your instructions on how to run your script might obviate the need for this, but beware that you need to be especially careful when running shell scripts with extended privileges. Check out the APPLICATION USAGE and EXAMPLES sections of the POSIXcommandutility's man page for a discussion on some of the issues that need to be considered when writing scripts to run with extended privileges.
Some systems have a utility named pwdck or (something similar to containing "pw", "pass", or "passwd" preceded by or followed by "ck" or" chk"). It sounds like your instructor is asking you to write a similar utility as a shell script.
Last edited by zaxxon; 08-19-2012 at 05:42 AM..
Reason: corrected a closing code tag
The utility mentioned above for checking the passwd file is called pwck. There is a similar utility for checking the group file called grpck.
If these utilities are available on your Operating System (whatever that is?), they are very useful.
Running SunOs 5.6. Solaris.
I've been able to remove all special characters from a fixed length file which appear in the first column but as a result all subsequent columns have shifted to the left by the amount of characters deleted.
It is a space separated file. Line 1 in input file is... (6 Replies)
Hi all,
As time progresses, the number of servers that I have to login to has grown to the hundreds.
Some of the servers has NIS so I can use one single password for this group of servers.
The hard part comes to when you have 20+ other servers that now require different passwords and... (4 Replies)
Hello guys
I am about to write a script that is based on "The Linux Administration Handbook" The exercise is as follows:
Write a shell script to help monitor the health of the /etc/passwd file.
Find entries that have UID0
Find entries that have no password (needs /etc/shadow)
Find any... (4 Replies)
I am developing a script to maintain 'n' number of versions of a file. The script will take a filename as a parameter and the number of versions to maintain. This basically does something like a FIFO. Here is what I developed. But something is not right. I have attached the script. Can u pls help... (2 Replies)
Not an unix expert, I read a few pages on the web about passwd files, but I didn't find the answers I need about the last 8 lines of the passwd file I'm taking a look at.
I'm assuming their shortcuts to another file that may have the actual usernames of users on the system.
Please, any help... (1 Reply)
Hi Folks,
I have Solaris 10, latest release.
We have passwd aging set in /etc/defalut/passwd.
I have an account that passwd should never expire. Acheived by emptying associated users shadow file entries for passwd aging.
When I reset the users passwd using passwd command, it re enables... (3 Replies)
I need to alter a file.
I'm using sed then passing output to temp file
then using touch -r to maintain the date but the permissions do not get preserved
How can I sed a file and maintain date and permissions
currently
it's preserving the date but the permissions revert back to the... (3 Replies)
Hi all,
As all of us know that in /etc/passwd file the first field correspond to username
could any one tell me what is bin , damoen etc in the first field, and r they in
user field , what is nologin in the last column ?
root:x:0:0:root:/root:/bin/bash ... (4 Replies)
