Create my own shadow password application

[Chua Wen Ching]

I am using HP-UX 10.20. As you can see the /etc/passwd consists of:
Example
--------
dh001614:jh2c7dFJOp.vI:5067:512:,,,:/users/students/200003/dh001614:/usr/bin/sh

I want to create my own unix system where you can add user, del similar to an inventory system. Now to encrypting the passwd. I know there is a command like crypt but it only encode passwd into something shown on top (jh2c7dFJOp.vI). But if i want to create my own shadow passwd system maybe:

dh001614:*:5067:512:,,,:/users/students/200003/dh001614:/usr/bin/sh

If not mistaken the * is actually link to a file hidden somewhere (maybe /etc/.shadow/...) in a unix system.

How to make such thing to happen (encryption + shadow)? Can bourne shell programming do that or i need to use C or Perl? Obviously i do not want to use Root access to accomplish it.

Can i create my own encrypt / decrypt in bourne shell programming?

Thank you.

[Michael Tully]

Yes, there is a command called 'crypt' that can be used to encrypt files, so that the contents can't be read. (one of it's uses) See the man page on it.

$ man crypt

The '*' character in the /etc/passwd file is used for two separate reasons depending on whether your system is trusted or not.
The first being that there is no password and that the account can't be used. The second is where the system has been set up as trusted. There is no actual /etc/shadow file like on other flavours of Unix. HP-UX uses a 'trusted database' of which files are placed under a directory tree of /tcb

In answer to creating your own, why, when it is in-built. To activate, simply use the '/usr/lbin/tsconvert' program.

[Darrell Allen]

Hi,

/usr/lbin/makekey can be used to encrypt a password. Check the man page.

On a non-trusted HP server, if the password field is * it means the account is locked. On a trusted system, all the programs that utilize the password file are aware there are "shadow" files (actually trusted computing base or tcb files). The * is not a link to a file somewhere.

I echo Michael's comments that it is much better to use what is provided by HP: convert to trusted systems. Creating your own security mechanism is in fact a huge security risk.

Darrell

[Chua Wen Ching]

I had tried to cd /tcb. It displays:
sh: /tcb: not found
It means by current unix system is a non-thrusted system. Ok. To Darren Allen, i had a question to ask you. The command /usr/lbin/makekey, may i know how to use it? I had check the man makekey, but it does not show me how to use it. Based on man, makekey is intended for programs that perform encryption (e.g. ed and crypt).
Can i use /usr/lbin/makekey < fileA > fileB??

Dear Michael Tully, when you say that in answer to create your own, when it is buiilt in. The problem here is i am not a root but i am using a normal student account in my org. I want to create my own trusted system for my personal research. Any idea if i am not a root?

But back to my first message, is it possible for me to point a * to a file? Just for additional knowledge only.

Really thanks for your help.

[Bill Hassell]

All the logic for a shadow password system is hardcoded into login and password plus a *lot* of other libraries. For 11.0 and higher, PAM is used for integrating multiple authentication methods. Authentication must be a complex process or it could easily be subverted. There is no possibility to write a script for creating a user login.

HP's Trusted system goes beyond a simple shadow file by creating a databse of user authentication features. The * is simply a placeholder in a trusted system. The code inside login and passwd know where the Trusted system data is located. The encrypted password can indeed be created with the crypt command but there are far too many other issues that must be addressed that are far beyond a shell script.

[Darrell Allen]

If /tcb does not exist, then your system is not trusted.

You will not have permissions to read anything in /tcb unless you are root.

Here's an example for using makekey:
$ encrypted_passwd=$(echo passwordY7 | /usr/lbin/makekey)
$ echo $encrypted_passwd
Y7mVtdV.zWazc

You will get the same result every time you pass the same 10 characters to makekey. If you change the salt, you will get a different result.

It appears you are trying to secure your personal research data. I believe you will need to encrypt all your data. The root user has access to anything on the system regardless of the permissions you set. If you don't encrypt your data, root can read it.

The best security for your research is to keep it on a system that no one else has access to.

Darrell

[Chua Wen Ching]

Dear Darrell Allen, thank you for showing me how to use makekey command. I think i understand much about thrusted system. Thank you for your help.

[Chua Wen Ching]

But there is a major problem here is that makekey is used to encrypt data. How am i suppose to decrypt? Thank you.

[Darrell Allen]

One feature of makekey is that you are not supposed to be able to decrypt its output. That's also the way it is with a user's encrypted password. It is possible to use a password cracker but it could take quite a bit of time.

makekey is not designed for encrypting a file. I mentioned it because I thought you wanted to know how to create encrypted passwords.

Michael Tully has already replied that you can use the crypt command to encrypt files. Read the man page for crypt for more information.

Darrell

[Chua Wen Ching]

Dear Darrell Allen, based on your reply that one feature of makekey is that you are not suppose to decrypt its output. I am a doing a unix system where i will store the encrypted passwd of students into a file passwd (like /etc/passwd). But when the particular student login, i need to decrypt the passwd so that i can compare whether the student had enter the correct password right? Is there no other way except using a password cracker like john the ripper. Password comparison is the major problem right here. Anyway thanks for your reply.

[Darrell Allen]

Let's look again at the makekey example I first provided:

$ encrypted_passwd=$(echo passwordY7 | /usr/lbin/makekey)
$ echo $encrypted_passwd
Y7mVtdV.zWazc

In this example, "passwordY7" is passed to makekey. The first 8 characters ("password") are to be encrypted. The 9th and 10th characters ("Y7") are the salt. man makekey for more information on the salt.

Every time you pass "passwordY7" to makekey, the resulting encrypted password will be "Y7mVtdV.zWazc". It will always return the same 13 characters. Notice the first 2 characters are "Y7", the salt. Whatever salt you use will be returned as the first 2 characters of the encrypted password.

Suppose you store Y7mVtdV.zWazc in a file as my encrypted password. Now whenever I enter my password, do the following:
- look at the first 2 characters of my encrypted password in the file to determine the salt
- pass the password I entered and the salt from the file to makekey
- compare the result from makekey with what you have stored in the file
- if they are the same, then I entered the correct password
- if they are not the same, then I did not enter the correct password

For example, suppose I enter "12345678" as my password. You need to take the salt from the encrypted password in the file. It is "Y7". Now do: echo 12345678Y7 | /usr/lbin/makekey. Compare the result with my encrypted password from the file. They will be different so you know I did not enter the correct password.

Remember, you must always pass 10 characters to makekey. If the entered password is less than 8 characters, you will need to add spaces between the password and salt. Example:
echo "pass Y7" | /usr/lbin/makekey
Note there should be 4 spaces above between pass and Y7 but the forums always compress spaces.

If the password is more than 8 characters, you can only use the first 8.

Darrell

[Bill Hassell]

The Unix password algorithm is based on the Enigma machine and produces and encrypted string that is not possible to decrypt. Instead, the login process simply compares what you type (after running it through crypt or makekey) and it the strings are the same, it is a match.

John the Ripper and it's ancestor, Crack are successful because of human nature. I would prefer a password like billh but that is far too trivial to guess. Crack programs are succesful because people choose easy passwords. An untrusted HP-UX system ignores characters beyond 8 (Trusted watches every character).

You can enforce a number of password rules (must have n special chars, must have n uppercase, must have n numeric, etc) by creating the /etc/default/security file. NOTE: does not apply to the obsolete 10.20 and earlier versions. You need to be up to date on patches.

Since you have a security problem, do not try to reinvent a security system--simply convert your system to Trusted (use SAM, select Auditing). Now you will have several pages of password controls and policies, and the encrypted passwords have been removed to a root-only directory where they cannot be seen by users.

Get the HP-UX Security book by Chris Wong as soon as possible. HP-UX is shipped as an open system and must be heavily modified before allowing users (especially students) to ever logon.

[Chua Wen Ching]

1) Okay, i just want to confirm something here. You mean example when the superuser created a user with password "passwordY7" (after encrypted using makekey) then is stored in a password file. When the user login, he only need to type the password and when we compare we will extract the Y7 from the password file. Right. So the conclusion here is the "salt" Y7 is created by the superuser but not the unix user right? I feel it is kind of problem whenever i create a user i need to specify a salt for the user. If there is 100 users, 100 different salt. Is there a possible to autogenerate the salt? Any sample salt autogeneration? I only know how to autogenerate alphabets but not alphanumeric.
2) What if the unix user change his password into abc123? (just assume he does not know that password needs 8 characters) So do my system need to add extra 2 spaces for him.
3) 8 characters + 2 salt is part of the makekey architecture right?
4) The salt for the unix user will always be the same right even he change his password?
Anyway i quite understand with your earlier explanation but i just want to confirm.
To Bill Hassell, i will ask my org to change to a trusted system soon. Thanks for your help.

[Darrell Allen]

For question 1)
In my example, the password was "password". "Y7" was the salt. You must pass the password and salt to makekey.

When a user changes his password, the salt is randomly chosen from the character set [a-zA-Z0-9./].

If you are going to utilize makekey, you should randomly chose the salt.

For question 2)
You must pass an 10 characters to makekey. The last 2 are the salt. If the user doesn't choose an 8 character password, you need to add enough spaces to get the required number of characters.

I suppose you could chose a character other than space to add to a short password. In fact, I don't know what the passwd command does.

You should test this yourself. Try several things. See what happens if you don't pass enough characters to makekey.

For question 3)
Yes

For question 4)
No. The system randomly selects the salt when the user (or the superuser) changes his password.

Darrell

[Chua Wen Ching]

Dear Darrell Allen, do you have any sample code to random autogenerate the "salt" or 2 characters with the format [a-zA-Z0-9./]? I only know how to autogenerate a - z (lowercase) and numbers only. But i do not know how to autogenerate "a7" or "f^" or "aB"? Thanks for your help as i understand how makekey works.

[Bill Hassell · Accepted solution]

I have attached a simple C program that will generate a standard 8-character max password.

NOTE: If you are going to change to a Trusted system, you'll need to modify your efforts to maintain users using your own shell scripts (you probably want to do that even now). Read the man pages for useradd, usermod and userdel. Additionally, you'll need to look at man pages for modprpw and getprpw (found at docs.hp.com) for future Trusted systems. If you elect to allow (or require) longer passwords than 8 characters) you'll need to modify you password generation code.