verify system username & password in a perl script

exodist · 08-14-2006, 06:32 PM

I am writing a perl cgi script, it will get a username and password from the user, it then needs to verify the username and password against the systems users. For various reasons I cannot simply use a password database seperate from the system on this one, it needs to be the system users.

so, how would I verify the username and password from within perl? I figure it would be simple if I could figure out how the passwords are encrypted in /etc/shadow (as inw hat command encrpyts the password string) then I could simply run:

Code:

$enc_pass = `echo "$Password" | password_encryptor`;
chomp($enc_pass);
open(SHADOW, '</etc/shadow');
foreach my $Line (<SHADOW>)
{
    return 1 if ($Line =~ m/^$username:$enc_pass/); #check if the encrypted password is on the same line as the username with only one colon between them (follows format of the shadow file)
}
close(SHADOW);
return 0;
#return 1 of it is valid, 0 if it is not.

dinojerm · 08-14-2006, 07:09 PM

The password field of the shadow file should be formatted something like this: "$1$asdf$foo", with the first part ($1$asdf) being the salt (unique to each entry)
In order to check the password in perl, you need to use both the salt and the input password. You can use something like this: (after reading in the line from the shadow file and extracting the salt to $salt)

Code:

use Crypt::PasswdMD5;
$enc_pass=unix_md5_crypt($Password,$salt);

If the password is correct, this function should return the same "$1$asdf$foo" string that was in the shadow file.

exodist · 08-14-2006, 07:26 PM

sweet, thank you very much

Intimidator · 08-15-2006, 04:42 AM

http://www.linuxquestions.org/questi...d.php?t=473878