Using the encrypted password of the shadow file


 
Thread Tools Search this Thread
Top Forums UNIX for Dummies Questions & Answers Using the encrypted password of the shadow file
# 1  
Old 06-06-2013
Using the encrypted password of the shadow file

i have an application that uses the encrypted password that's in the /etc/shadow file.

i copied the line for the particular username i was interested it in from shadow file and i pasted it into the password file of the application. the application is nagios.

this application allowed that particular user access as long as she entered the right password.

my question is, how can i authenticate users using the shadow password file? i'd like to do this in my own scripts.

for instance if a user enters "Apple" for a password. when encrypted, that will be scrambled to look differently (as it is in the shadow file). how can i make it so if a user is running a script, i want to make sure its the right user. not someone posing as the user.

i already tried:

Code:
echo "Apple" | md5sum

but the resulting scrambled letters do not match that of the /etc/shadow.

OS: Linux/SunOS/HPUX

Thank you all
# 2  
Old 06-06-2013
I think you are trying to do this from the wrong side. If you want to make sure only the right user can execute the script, then, instead of using passwords, make the script executable only for that user account (or group, if there are several users).

I hope this helps.

bakunin
# 3  
Old 06-06-2013
Quote:
Originally Posted by SkySmart
my question is, how can i authenticate users using the shadow password file? i'd like to do this in my own scripts.
The shadow file does not work that way. The passwords are obscured further than md5 (salted) to make them even more difficult to decipher.

I'm not sure they even use md5 for passwords anymore -- it turned out to have a major flaw.

Quote:
how can i make it so if a user is running a script, i want to make sure its the right user. not someone posing as the user.
If they can login as the correct user, they're probably the correct user, so use file access permissions to prevent anyone but that user from executing it.

This will also be a whole lot easier than trying to parse shadow files from three very different operating systems.
# 4  
Old 06-06-2013
thank you guys!

yeah file permission setting is completely out of the equation since everyone has root here. that's out of my control. but what is under my control is making sure script is inoperable unless the proper password is written.

i'm thinking, if i can grab a line from the shadow file, insert it in the nagios password file htpasswd.users and have it actually work, then i need to figure out how Nagios is doing it. surely, if nagios can do it, i can.

Last edited by SkySmart; 06-06-2013 at 09:44 PM..
# 5  
Old 06-06-2013
Quote:
Originally Posted by SkySmart
yeah file permission setting is completely out of the equation since everyone has root here. that's out of my control. but what is under my control is making sure script is inoperable unless the proper password is written.
If everyone has root, then why bother? If everyone has root, any countermeasure can be undermined and neither security nor accountability are a priority.

So, obviously, this system is insecure. That may acceptable; we don't know any of the particulars. If you explain what you are to trying to accomplish, instead of asking how to implement what you think is the solution, we may be able to provide useful advice.

As it stands, what you have asked is nonsensical. How can you use the shadow file to defend against an attacker who has permission to modify the shadow file?

Regards,
Alister

P.S. With regard to authenticating using the shadow file, it can be done using whatever interfaces your system provides to login, nagios, etc (my UNIX doesn't have a shadow file).

Last edited by alister; 06-06-2013 at 10:24 PM..
# 6  
Old 06-07-2013
Quote:
Originally Posted by SkySmart
yeah file permission setting is completely out of the equation since everyone has root here.
If everyone has root, you are -- to put it delicately -- screwed. You cannot prevent root from being root.
 
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Replace encrypted password in /etc/shadow using sed

Hello friends, We have encrypted password strings for all of our users (each user has different password). After creating users in Linux, we replace encrypted passwords manually on /etc/shadow so that their passwords directly work. Instead we want to do it using scripting. I tried with sed... (2 Replies)
Discussion started by: prvnrk
2 Replies

2. Shell Programming and Scripting

how to remove the non : characters after the password in shadow file?

On SPARC Solaris 10. I set the app account so it's expired. I also want it so not required to change password at first login, I can do this by removing the numbers after the password in /etc/shadow. example using user1 The /etc/shadow file looks like this: user1:kOmcVXAImRTAY:0::::90:: ... (8 Replies)
Discussion started by: TKD
8 Replies

3. Red Hat

Shadow file password policy

Today i was going through some of security guides written on linux . Under shadow file security following points were mentioned. 1)The encrypted password stored under /etc/shadow file should have more than 14-25 characters. 2)Usernames in shadow file must satisfy to all the same rules as... (14 Replies)
Discussion started by: pinga123
14 Replies

4. UNIX for Advanced & Expert Users

/etc/shadow encrypted password

Hi I wonder whether is possible to generate enrypted passwd for some user and paste it into /etc/shadow file ? What kind of encryption is used in /etc/shadow file ? ths for help. (1 Reply)
Discussion started by: presul
1 Replies

5. Solaris

Password Recovery From /etc/shadow file

Is it possible to reset a normal user password , by editing password field in /etc/shadow file? Thanks (6 Replies)
Discussion started by: ksvaisakh
6 Replies

6. UNIX for Dummies Questions & Answers

How to : Identify the the password is encrypted or not in /etc/shadow or /etc/passwd?

Thanks AVKlinux (11 Replies)
Discussion started by: avklinux
11 Replies

7. Linux

Interpreting the encrypted shadow password?

We are currently using a script to copy the same encrypted password between our HP-UX and Solaris servers editing the trusted and shadow files directly. The encrypted password is only 13 characters long on both servers and decrypts the same way. Is there a way to copy this same string to Linux... (5 Replies)
Discussion started by: keelba
5 Replies

8. UNIX for Dummies Questions & Answers

shadow file after a password reset

hi, I had to reset a lost root password by editing the /etc/passwd and /etc/shadow files ( this is a xen vm file, so i mounted and chrooted the file ) after the reboot with an empty password on root , i have set a new password with passwd but it only changed the /etc/passwd file.... (0 Replies)
Discussion started by: progressdll
0 Replies

9. Shell Programming and Scripting

I want to append password in /etc/shadow file

Hi, I want to append password into /etc/shadow file using a shell script. My below script does add the users to both /etc/passwd and /etc/shadow but how can I add the hordcoded passwords to /etc/shadow file can some one help me ? # To add the groups into /etc/group file for a_user... (5 Replies)
Discussion started by: modgil
5 Replies

10. UNIX for Advanced & Expert Users

netrc file encrypted password

Hi, I do not want the plaintext password to appear in the netrc file. So I want to encrypt the password. Is there a way to encrypt the password and still make ftp to use the netrc ? Thanks in advance. -Gow:confused: (2 Replies)
Discussion started by: ggowrish
2 Replies
Login or Register to Ask a Question