mikei@ctdi.UUCP (Mike Israel) (11/17/89)
I have a question regarding the use of the "C" function
"getpwent" under AT&T's Unix SYSV/386 Release 3.2.
This particular version of Unix stores encrypted passwords
in a file called /etc/shadow. The standard /etc/password field
for the encrypted password simply contains an 'x'. Using
"getpwent" simply retrieves this 'x'.
Is there an existing function to access the encrypted password?
--
Michael A. Israel || uucp: mikei@ctdi.UUCP
|| ...!uunet!cbmvax!ctdi1!ctdi
Communications Test Design Inc. ||
West Chester, PA || I think therefore I am confused.gwyn@smoke.BRL.MIL (Doug Gwyn) (11/18/89)
In article <785@ctdi.UUCP> mikei@ctdi.UUCP (Mike Israel) writes:
-This particular version of Unix stores encrypted passwords
-in a file called /etc/shadow. The standard /etc/password field
-for the encrypted password simply contains an 'x'. Using
-"getpwent" simply retrieves this 'x'.
-Is there an existing function to access the encrypted password?
NO, that's the whole point of having /etc/shadow.cpcahil@virtech.uucp (Conor P. Cahill) (11/20/89)
In article <785@ctdi.UUCP>, mikei@ctdi.UUCP (Mike Israel) writes: > I have a question regarding the use of the "C" function > "getpwent" under AT&T's Unix SYSV/386 Release 3.2. > > This particular version of Unix stores encrypted passwords > in a file called /etc/shadow. The standard /etc/password field > for the encrypted password simply contains an 'x'. Using > "getpwent" simply retrieves this 'x'. > > Is there an existing function to access the encrypted password? The set of functions used to access the shadow file are named similar to the getpwent family of functions but use an "sp" instead of the "pw". So you have a getspent(), etc. /usr/include/shadow.h has the structures used by these functions. I can't find any reference to these functions in the 386/ix, AT&T, or Bell Tech documentation sets. Since they seem to be designed to replace the getpwent functions I would assume that the functionality is the same. -- +-----------------------------------------------------------------------+ | Conor P. Cahill uunet!virtech!cpcahil 703-430-9247 ! | Virtual Technologies Inc., P. O. Box 876, Sterling, VA 22170 | +-----------------------------------------------------------------------+
CCDN@levels.sait.edu.au (david newall) (11/21/89)
In article <11633@smoke.BRL.MIL>, gwyn@smoke.BRL.MIL (Doug Gwyn) writes: > In article <785@ctdi.UUCP> mikei@ctdi.UUCP (Mike Israel) writes: > -This particular version of Unix stores encrypted passwords > -in a file called /etc/shadow. Is there an existing function > -to access the encrypted password? > > NO, that's the whole point of having /etc/shadow. I'm most surprised to hear Doug claiming that the purpose of /etc/shadow is so that "encrypted" passwords can't be easily accessed. I'm sure that no such thing is the case. The purpose of the shadow password file is so that unprivileged processes cannot access the "encrypted" password. That's a security consideration. (I personally feel that even unprivileged processes can have some need to authenticate arbitrary users; and that having them type their password is a reasonable authentication scheme. But that's another issue.) The purpose of /etc/shadow is NOT to make it inconvenient to access this data, assuming you have permission to access it. I would have thought it reasonable for getpwent to fill in the pw_passwd field if it was invoked by root. Alternatively, I would have thought "getshadowent" routines would have been provided (for the exclusive use of root processes). David Newall Phone: +61 8 343 3160 Unix Systems Programmer Fax: +61 8 349 6939 Academic Computing Service E-mail: ccdn@levels.sait.oz.au SA Institute of Technology Post: The Levels, South Australia, 5095
marc@dumbcat.UUCP (Marco S Hyman) (11/21/89)
In article <1989Nov19.203748.22680@virtech.uucp> cpcahil@virtech.uucp (Conor P. Cahill) writes:
The set of functions used to access the shadow file are named
similar to the getpwent family of functions but use an "sp" instead
of the "pw". So you have a getspent(), etc.
/usr/include/shadow.h has the structures used by these functions.
I can't find any reference to these functions in the 386/ix, AT&T,
or Bell Tech documentation sets.
Check out the ``AT&T UNIX V.3.2 Integrated Software Development Guide'' that
comes with the 386/ix software development package. Appendix A has man
pages for both getspent(3X) and putspent(3X).
// marc
--
// Marco S. Hyman {ames,pyramid,sun}!pacbell!dumbcat!marcstevea@laiter.i88.isc.com (Steve Alexander) (11/21/89)
In article <2941@levels.sait.edu.au> CCDN@levels.sait.edu.au (david newall) writes: >The purpose of /etc/shadow is NOT to make it inconvenient to access this >data, assuming you have permission to access it. I would have thought it >reasonable for getpwent to fill in the pw_passwd field if it was invoked >by root. Alternatively, I would have thought "getshadowent" routines would >have been provided (for the exclusive use of root processes). There are functions to access the shadow password file. They are in /usr/lib/libsec.a. There is a header file <shadow.h> that must be included in order to use these functions. Obviously this will only work if the effective uid is root. These functions return a pointer to a struct spwd which is defined in shadow.h. Otherwise they work a lot like the normal password routines. There are also some password file locking routines in libsec.a; presumably they are used when writing an entry to a password file. -- Steve Alexander, Software Technologies Group | stevea@i88.isc.com INTERACTIVE Systems Corporation, Naperville, IL | ...!{sun,ico}!laidbak!stevea
lbert359@pallas.UUCP (Lee Bertagnolli) (11/22/89)
Manual pages for /etc/shadow-related functions (e.g., getspent()) may be found in AT&T's Integrated Software Development Guide (ISDG), document id # 999-300-523. This manual has a load of info on tuning, porting, and device driver development. AT&T says the target audience for this manual is VAR's, ISV's, and IHV's, so I don't know if it is generally available. Regards, Lee Bertagnolli lbert359@athenanet.com
gwyn@smoke.BRL.MIL (Doug Gwyn) (11/23/89)
In article <2941@levels.sait.edu.au> CCDN@levels.sait.edu.au (david newall) writes: >I would have thought it reasonable for getpwent to fill in the pw_passwd >field if it was invoked by root. Alternatively, I would have thought >"getshadowent" routines would have been provided (for the exclusive use >of root processes). This is thinking the wrong way about encrypted passwords. The encryption is intended to be a ONE-way operation; therefore reading back the result is not in line with the design of the password scheme. Also, implementation of encryption should be isolated from applications (so that it can be changed if necessary without breaking existing applications). Requiring infinite privileges in order to test password validity is also not a wise policy. What you really need is a function that validates an UNencrypted putative password against the encrypted version; that is the only valid use of the encrypted password. Such a validating function would of course have to at some point exploit temporary privileges in order to access the shadow file. It should also be fairly slow, to make it useless in batch password cracking. I don't know whether your system provides such a function or not.