Redhat 6.0 encrypted passwords (34 characters vs. 13 for Redhat 5.2)

Redhat 6.0 encrypted passwords (34 characters vs. 13 for Redhat 5.2)

Post by Michael Samso » Sat, 19 Jun 1999 04:00:00



Hello all,

I recently was checking out Redhat 6.0 and noticed that a password
program I had created for Redhat 5.2 no longer worked for Redhat 6.0.

On Redhat 5.2

- using getpwnam to obtain the encrypted password of a user returns 13
characters

- and a 2 character salt is required to obtain the encrypted password from
the plain text password (using
crypt(plain_text_password , first_two_characters_of_encrypted_password);

On Redhat 6.0
- you have to use getspname (not getpwnam) to obtain the encrypted
password of a user and this returns 34 characters.

- and an 11 character salt is required to obtain the encrypted password
from the plain text password (using
crypt(plain_text_password , first_eleven_characters_of_encrypted_password);

What is going on?
The security model has changed slightly - but
why a
2 character salt for 13 character encrypted password
versus
an
11 character salt for a 34 character encrypted password

Where is this documented, and will this change for other versions of Linux
as well.

Here is a program that verifies this.....
You have to set it up for one of the users on your machine....

Thanks,
Mike

#include <stdio.h>
#include <stdlib.h>
#include <pwd.h>
#include <sys/types.h>
#include <string.h>
#include <shadow.h>
#include <crypt.h>

main(){

    char anAcctName[128];

    // edit this for a user on your machine !!!!!!!
    strcpy(anAcctName,"msamson");

    char *aPassword=NULL;
    printf("Redhat 6.0 - Using getspnam to get password\n");
    struct spwd *sp = getspnam(anAcctName);
    if (sp) {
        aPassword = strdup(sp->sp_pwdp);
        printf("getspnam worked - %s length - %d\n",
            aPassword,strlen(aPassword));
    }
    else{
        printf("getspnam failed\n");
    }
    endspent();

    if(aPassword == NULL){
        printf("Redhat 5.2 - Using getpwnam to get password\n");
        aPassword = NULL;
        struct passwd *p = getpwnam(anAcctName);
        if (p) {
            aPassword = strdup(p->pw_passwd);
            printf("getpwnam worked - %s length - %d\n",
                aPassword,strlen(aPassword));
        }
        else{
            printf("getpwnam failed\n");
        }
    }

    if(aPassword){
        char encrypt_key[64];
        char *encrypted_password = NULL;

        for(int x=1;x<=36;x++){
            memset(encrypt_key,'\0',sizeof(encrypt_key));
            if(x>strlen(aPassword)){
                exit(0);
            }
            strncpy(encrypt_key,aPassword,x);

            // also edit this for user on your machine

            printf("calling crypt(%s,%s)\n","mypass",encrypt_key);
            encrypted_password = crypt("mypass",encrypt_key);

            if(encrypted_password){
                printf("%d encrypted password = %
s\n",x,encrypted_password);
                if(strcmp(encrypted_password,aPassword)==0){
                    printf("Password created with crypt matches system
password\n");
                    exit(0);
                }
            }
            printf("\n");
        }
    }

Quote:}

------------------  Posted via SearchLinux  ------------------
                  http://www.searchlinux.com

---------------------------------------------------------------------------
-----

------------------  Posted via SearchLinux  ------------------
                  http://www.searchlinux.com

 
 
 

Redhat 6.0 encrypted passwords (34 characters vs. 13 for Redhat 5.2)

Post by Villy Kru » Sat, 19 Jun 1999 04:00:00




Quote:>What is going on?
>The security model has changed slightly - but
>why a
>2 character salt for 13 character encrypted password
>versus
>an
>11 character salt for a 34 character encrypted password

>Where is this documented, and will this change for other versions of Linux
>as well.

>Here is a program that verifies this.....
>You have to set it up for one of the users on your machine....

You remeber the question during install whether you want MD5 password
checking?  It got to be related to that.  You probably need to use the
pam interface to the password stuff so your program becomes independent
of the actual password format.

Villy

 
 
 

Redhat 6.0 encrypted passwords (34 characters vs. 13 for Redhat 5.2)

Post by Alan Cur » Mon, 21 Jun 1999 04:00:00




Quote:

>On Redhat 5.2

>- and a 2 character salt is required to obtain the encrypted password from
>the plain text password (using
>crypt(plain_text_password , first_two_characters_of_encrypted_password);
>On Redhat 6.0
>- and an 11 character salt is required to obtain the encrypted password
>from the plain text password (using
>crypt(plain_text_password , first_eleven_characters_of_encrypted_password);

It's not necessarily 11 characters; the MD5 salt length is variable. It is
everything up to the last $ in the encrypted password.

The correct and easy way to handle this is to just pass the entire encrypted
password as the second arg to crypt(). It knows how to autodetect the
difference between DES and MD5 passwords, and it knows to look for the $ in
the MD5 or just use the first two characters in the DES case.

Quote:>Where is this documented, and will this change for other versions of Linux
>as well.

The format of the password and salt is documented in the glibc info pages,
/usr/info/glibc.* in case you're curious, but for the purpose of checkign an
existing password you don't need to know it. Just pass the whole encrypted
password as the salt and let the library do the work.

Your sample program looked pretty wacky, here is a fixed-up version:

#include <stdio.h>
#include <stdlib.h>
#include <pwd.h>
#include <sys/types.h>
#include <string.h>
#include <shadow.h>
#include <crypt.h>

int main(void)
{
    char anAcctName[128];

    /* edit this for a user on your machine !!!!!!! */
    strcpy(anAcctName,"msamson");

    char *aPassword=NULL;
    /* Why are you obsessed with redhat versions? They are pretty much
     * irrelevant. redhat 5 can be shadowed and redhat 6 can be unshadowed
     * quite easily. And Redhat!=Linux anyway. */
    printf("Trying getspnam to get password\n");
    struct spwd *sp = getspnam(anAcctName);
    if (sp) {
        aPassword = strdup(sp->sp_pwdp);
        printf("getspnam worked - %s length - %d\n",
            aPassword,strlen(aPassword));
    }
    else{
        printf("getspnam failed\n");
    }
    endspent();

    if(aPassword == NULL){
        printf("Trying getpwnam to get password\n");
        aPassword = NULL;
        struct passwd *p = getpwnam(anAcctName);
        if (p) {
            aPassword = strdup(p->pw_passwd);
            printf("getpwnam worked - %s length - %d\n",
                aPassword,strlen(aPassword));
        }
        else{
            printf("getpwnam failed\n");
        }
    }

    if(aPassword)
    {
        char encrypt_key[64];
        char *encrypted_password = NULL;

        /* also edit this for user on your machine */
        printf("calling crypt(%s,%s)\n","mypass",aPassword);
        encrypted_password = crypt("mypass",aPassword);

        if(encrypted_password){
            printf("%d encrypted password = %s\n",x,encrypted_password);
            if(strcmp(encrypted_password,aPassword)==0){
                printf("Password created with crypt matches system password\n");
                exit(0);
            }
        }
        printf("\n");
    }

Quote:}
>------------------  Posted via SearchLinux  ------------------
>                  http://www.searchlinux.com

Someone tell "searchlinux" that usenet posts are not supposed to have ^M's in
them, and are not supposed to have linebreaks inserted randomly.
--
Alan Curry    |Declaration of   | _../\. ./\.._     ____.    ____.

--------------+save some time): |  \__/   \__/     \___:    \___:
 Linux,vim,trn,GPL,zsh,qmail,^H | "Screw you guys, I'm going home" -- Cartman
 
 
 

Redhat 6.0 encrypted passwords (34 characters vs. 13 for Redhat 5.2)

Post by Michael Samso » Tue, 22 Jun 1999 04:00:00


I can't pass the whole encrypted password.
Can I just search for the last occurance of $ in the encrypted password
and send that??




> >On Redhat 5.2

> >- and a 2 character salt is required to obtain the encrypted password
from
> >the plain text password (using
> >crypt(plain_text_password , first_two_characters_of_encrypted_password);

> >On Redhat 6.0
> >- and an 11 character salt is required to obtain the encrypted password
> >from the plain text password (using
> >crypt(plain_text_password ,

first_eleven_characters_of_encrypted_password);

- Show quoted text -

> It's not necessarily 11 characters; the MD5 salt length is variable. It
is
> everything up to the last $ in the encrypted password.

> The correct and easy way to handle this is to just pass the entire
encrypted
> password as the second arg to crypt(). It knows how to autodetect the
> difference between DES and MD5 passwords, and it knows to look for the $
in
> the MD5 or just use the first two characters in the DES case.

> >Where is this documented, and will this change for other versions of
Linux
> >as well.

> The format of the password and salt is documented in the glibc info
pages,
> /usr/info/glibc.* in case you're curious, but for the purpose of
checkign an
> existing password you don't need to know it. Just pass the whole
encrypted
> password as the salt and let the library do the work.

> Your sample program looked pretty wacky, here is a fixed-up version:

> #include <stdio.h>
> #include <stdlib.h>
> #include <pwd.h>
> #include <sys/types.h>
> #include <string.h>
> #include <shadow.h>
> #include <crypt.h>

> int main(void)
> {
>     char anAcctName[128];

>     /* edit this for a user on your machine !!!!!!! */
>     strcpy(anAcctName,"msamson");

>     char *aPassword=NULL;
>     /* Why are you obsessed with redhat versions? They are pretty much
>      * irrelevant. redhat 5 can be shadowed and redhat 6 can be
unshadowed
>      * quite easily. And Redhat!=Linux anyway. */
>     printf("Trying getspnam to get password\n");
>     struct spwd    *sp = getspnam(anAcctName);
>     if (sp) {
>         aPassword = strdup(sp->sp_pwdp);
>         printf("getspnam worked - %s length - %d\n",
>             aPassword,strlen(aPassword));
>     }
>     else{
>         printf("getspnam failed\n");
>     }
>     endspent();

>     if(aPassword == NULL){
>         printf("Trying getpwnam to get password\n");
>         aPassword = NULL;
>         struct passwd *p = getpwnam(anAcctName);
>         if (p) {
>             aPassword = strdup(p->pw_passwd);
>             printf("getpwnam worked - %s length - %d\n",
>                 aPassword,strlen(aPassword));
>         }
>         else{
>             printf("getpwnam failed\n");
>         }
>     }

>     if(aPassword)
>     {
>         char encrypt_key[64];
>         char *encrypted_password = NULL;

>         /* also edit this for user on your machine */
>         printf("calling crypt(%s,%s)\n","mypass",aPassword);
>         encrypted_password = crypt("mypass",aPassword);

>         if(encrypted_password){
>             printf("%d encrypted password = %s\n",x,encrypted_password);
>             if(strcmp(encrypted_password,aPassword)==0){
>                 printf("Password created with crypt matches system
password\n");
>                 exit(0);
>             }
>         }
>         printf("\n");
>     }
> }

> >------------------  Posted via SearchLinux  ------------------
> >                  http://www.searchlinux.com

> Someone tell "searchlinux" that usenet posts are not supposed to have
^M's in
> them, and are not supposed to have linebreaks inserted randomly.
> --
> Alan Curry    |Declaration of   | _../\. ./\.._     ____.    ____.

> --------------+save some time): |  \__/   \__/     \___:    \___:
>  Linux,vim,trn,GPL,zsh,qmail,^H | "Screw you guys, I'm going home" --

Cartman

------------------  Posted via SearchLinux  ------------------
                  http://www.searchlinux.com

 
 
 

Redhat 6.0 encrypted passwords (34 characters vs. 13 for Redhat 5.2)

Post by Alan Cur » Tue, 22 Jun 1999 04:00:00



reverse-time-warp order, and inserting ^M's on every line:

Quote:>I can't pass the whole encrypted password.

Why not?

Quote:>Can I just search for the last occurance of $ in the encrypted password
>and send that??

You're just making extra work for yourself. That's exactly what the crypt()
function is going to do anyway. Why do it twice?
--
Alan Curry    |Declaration of   | _../\. ./\.._     ____.    ____.

--------------+save some time): |  \__/   \__/     \___:    \___:
 Linux,vim,trn,GPL,zsh,qmail,^H | "Screw you guys, I'm going home" -- Cartman
 
 
 

1. Redhat 5.2 vs RedHat 6.0

I wrote this piece of software for RedHat 5.2 (compiler GCC) in order to
check timer event.
After installing RedHat 6.0 (compiler is EGCS) with the new LIBC , this
software doesn't work.

With RedHat 5.2, Alarm signal is running after setting up the timer
whereas it is never ran with RedHat 6.0.
Is my piece of software bad or is there any bug with RH6.0 libc or
EGCS ?

Thanks.

2. SPICE for Linux

3. Installing RedHat 6.0 over Redhat 5.2

4. Piping to/from ftp?

5. RedHat 5.2 -> RedHat 6.0 Upgrade Problems

6. Kernel panic in 1.3.45 (CM206 &

7. Redhat 5.2 vs 6.0...

8. NIS problems

9. RedHat 7.3 vs RedHat 6.0 SCSI performance

10. Redhat 6.0 vs Redhat 7.0

11. Sybase ASE, Character Device and RedHat 5.2

12. redhat 6.0 with 5.2 kernal

13. How to upgrade from RedHat 5.2 to 6.0 ?