1

I got a linux server that has several dozen users. I also have the cleartext password for every user (i know - bad security).

I would like to know if the passwords are correct. Since the users are all ftp users and have the nologin shell, I cannot just write a script to check if login works.

How can I do a local check on passwords? Script output could look like this:

$ check_userpw < user_pw_list.txt
user1 ok
user2 ok
user3 mismatch!
user4 ok

Thanks

2 Answers 2

2

If your users are authenticated against local passwords stored in /etc/shadow, you can generate the hashes and compare them yourself.

For MD5 hashes, the field looks like this:

$1$5q9TrKNO$YeVQrfsitsGlapGwhAjIl.

(The ending period is included. This is a hash for the string 'abc'.)

The $ are separators. The 1 in the first field identifies the hash as MD5, and the 5q9TrKNO is a salt randomly generated when the password was set to make dictionary attacks more difficult.

You can use this perl module to test the hash of your saved password: use the salt from /etc/shadow and the password you have, then check that the result matches the last section.

4
  • Thank you for pointing this out. I also thought about comparing the shadow hashes. But it seems that those are different on every machine because of the salt? I'm looking for a very easy way to just verify if the password matches. :)
    – zero_r
    Jan 4, 2011 at 16:06
  • @zero_r, use the crypt() function, and pass the full password hash as the salt, and the clear text version of the password to verify. Crypt will be able to figure out what part of the hash is the salt for you.
    – Zoredache
    Jan 4, 2011 at 19:12
  • I managed to do it with a perl script. What about password which don't have a salt? I have some users (on a RHEL 3) system which don't have a salt.
    – zero_r
    Jan 5, 2011 at 11:04
  • 1
    The perl module's superclass will work for any form of the crypt password hash, even the traditional non-salted DES. Authen-Passphrase The match function seems to fit perfectly Jan 5, 2011 at 12:33
2

You could write a script to automate an FTP login on each one using Perl's Net::FTP or GNU Expect or whatever you like, but probably the dead simplest way would be to piggyback on the check_ftp program in Nagios-Plugins. It will return non-zero if the login fails.

2
  • The thing is, it's a clustered FTP service and I have to verify if on both nodes the passwords are the same. I cannot failover because it's not sure whether the passwords work on the standby node. So checking via ftp is not an option.
    – zero_r
    Jan 4, 2011 at 14:57
  • 1
    Test on one node, fail over, test the other node. Alternatively, you can check the /etc/shadow files on each host, pull the salt from the password hash, crypt() your cleartext passwords with the salt you grabbed, and you should end up with the same hash. Jan 4, 2011 at 15:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .