crack on trusted system

[Jannik]

Hey all,
Iâ m running crack to check whether or not my users are using password that are not guessable. My problems are what do I do on a trusted system. Is there somebody out there that have created a script to merge /tcb/files/auth and /etc/passwd into a separate file?
This is my go:

#!/usr/bin/ksh

for i in $(cat /etc/passwd | cut -b 1)
do
cd /tcb/files/auth/$i
for j in $(ls $PWD)
do
echo $j
for k in $(cat $j | grep u_pwd | cut -d : -f 2 | cut -d = -f 2)
do
echo $k
done
done
done

This only creates a list of users and there password encrypte

[Simon Hargrave · Accepted solution]

How about this: -

cat /tcb/files/auth/?/* | awk '
/u_name/ { split($0,a,":|=|#"); name=a[3]; uid=a[5]; }
/u_pwd/ { split($0,a,":|="); pass=a[3]; }
pass != "" {
printf("%s:%s:%s:0:No Name:/home:/usr/bin/false\n",name,uid,pass);
pass="" ; name="" ; uid="";
}

'

[generic_1]

Symantec has a unix product I believe that checks password security on trusted and untrusted unix systems with a variety of options.

[RAC_1]

for i in `logins -a|awk '{print $1}'`
do
pass=`cat /tcb/files/auth/?/$i|grep "u_pwd"|awk -f : '{print $2}'`
grep $i /etc/passwd|awk -F : -v x=${pass}'{print $1:$x:$3:$4:$5:$6:$7}' >> /tmp/pass_file
done

Anil

[Steven E. Protter]

I just copied all the password files in /tcb to one gigantic file and let crack have at that.

Worked out just fine.

On Shadowed systems let crack attack a copy of the shadow file.

DO NOT, under any circumstances let crack actually touch the real password file.

Bad things can happen.

SEP

[Sundar_7]

But tell you what, I dont believe "crack" will be able to guess any passwords from the trusted system.

Even with the basic triviality checks, the user password is supposed to have at least two alphabetic characters and at least one numeric or special character. As far as I can reach, "crack" only tries to guess the password from the dictionary database it has.

I would be curious to know if you managed to crack any trusted system password.

[Bill Hassell]

Actually, crack has a bit more sophistication than a simple dictionary match. It will try substituting common characters such as 0 (zero) for O (letter o), l (letter L) for 1 (one) or i (letter i), etc to crack b1llh, adding trivial numbers to the front and back (billh1 or billh9), and some common capitalization (Billh). crack saves a lot of time by using the GECOS field for hints (the user name, phone, etc).

crack will have troubles with imbedded numbers (bi26llh) and mixed case (bIllH) as well as non-words (g7fG4tT). Of course, humans have big problems with g7fG4tT also).

Whether the system is standard, Trusted or uses a shadow password, the encryption is the same (man crypt and makekey). The crypt process is lossy which means that there is no decryption possible, only guessing which crack performs. Once you have the actual encrypted password fields, crack just does a brute force guess using the dictionary and applying variations. crack 5.0 has dozens of rule definitions so you can customize the variant searches (and drastically increase the amount of CPU time).

[Sridhar Bhaskarla]

Hi,

This is my version of make_passwd script.

cp /etc/passwd tmp$$
while read line
do
USER=$(echo $line|awk '{FS=":";print $1}')
echo "making entry for $USER"
FL=$(echo $USER|cut -c 1)
ENC=$(grep "u_pwd" /tcb/files/auth/${FL}/${USER} |awk '{FS="=";print $2}' |awk '
{FS=":";print $1}')
echo $line |awk -v enc=$ENC -F":" '{$2=enc;OFS=":";print $0}' >> crack_pa
sswd
done < tmp$$
rm tmp$$

I like crack. It gives you an ability to specify your custom dictionaries. One of the features of my dream IT datacenter is running a dedicated system that runs nothing but Crack program constantly gathering and crunching the password files from all other systems in a round-robin fashion. But for me rule 1 is not giving a user choice to set weak passwords. This can be controlled by trusted features as well making use of /etc/default/security file. Crack comes next.

-Sri

[Sridhar Bhaskarla]

Hi,

This is my version of make_passwd script.

cp /etc/passwd tmp$$
while read line
do
USER=$(echo $line|awk '{FS=":";print $1}')
echo "making entry for $USER"
FL=$(echo $USER|cut -c 1)
ENC=$(grep "u_pwd" /tcb/files/auth/${FL}/${USER} |awk '{FS="=";print $2}' |awk '
{FS=":";print $1}')
echo $line |awk -v enc=$ENC -F":" '{$2=enc;OFS=":";print $0}' >> crack_pa
sswd
done < tmp$$
rm tmp$$

I like crack. It gives you an ability to specify your custom dictionaries. One of the features of my dream IT datacenter is running a dedicated system that runs nothing but Crack program constantly gathering and crunching the password files from all other systems in a round-robin fashion. But for me rule 1 is not giving a user choice to set weak passwords. This can be controlled by trusted features as well making use of /etc/default/security file. Crack comes next.

-Sri

[Michael R. Monteith]

Hi Sri,
I prefer John The Ripper myself. I've also compiled a 900K word dictionary if you're ever interested.

Michael