topic Re: Password verification in Operating System - HP-UX

Password verification

TheJuiceman — Tue, 08 Mar 2005 20:16:57 GMT

Hello again,

Without going to a trusted system, how could I create a script that whenever a user changes their password that it will check to verify that it cannot be easily cracked by Satan or something like that? I want to make it where when they put in a new password that the script will try to crack it and then accept it or make them enter a new one depending upon the outcome.

Thanks for the help.
Bob

Re: Password verification

A. Clay Stephenson — Tue, 08 Mar 2005 21:05:34 GMT

It's much, much easier to apply tests to the plaintext passwd before it is hashed. You might find it more useful to come up with a replacement for the passwd command. As a matter of fact, you could actually do every bit of it with Perl because it has functions to retrieve the passwd fields and also has crypt() which can be used to create the hash. There are also modules which will write the passwd entry back for you. Another approach is npasswd. Do a search for it. If you insist upon doing a test after the fact then your approach should be to feed crack with the hash and see how it fares.

Re: Password verification

TheJuiceman — Tue, 08 Mar 2005 21:50:34 GMT

Thanks!!! This sounds promising!!! Would you have any examples of how to go about this? Thanks again!!!

Re: Password verification

Mic V. — Tue, 08 Mar 2005 23:49:21 GMT

It seems to me there was one in either of the books "Programming Perl" or "Learning Perl" several versions old. I'll post again if I can find it online.

Mic

Re: Password verification

Mic V. — Tue, 08 Mar 2005 23:52:06 GMT

Duh, should have just kept looking a little longer. Of course, posting the previous message made it pop up in the search engine. :-) Check out "anlpasswd" at:

http://www.kitetoa.com/_Export/Security_tools_1.html

It sounds like what you're looking for.

HTH,
Mic

Re: Password verification

TheJuiceman — Mon, 14 Mar 2005 20:52:27 GMT

Hey Mic,

This sounds perfect!!! Are there any "gotchas" on HP-UX 11.11 that you know of?

Thanks
Bobby

Re: Password verification

Mic V. — Mon, 14 Mar 2005 22:17:48 GMT

Not that I'm aware of! :-) Would you post your success story? I'm curious.

Mic

Re: Password verification

TheJuiceman — Mon, 14 Mar 2005 22:55:52 GMT

Absolutely!!! I will begin work on it and let you know!!! Thanks for the help!!!