Password verification

[TheJuiceman]

Hello again,

Without going to a trusted system, how could I create a script that whenever a user changes their password that it will check to verify that it cannot be easily cracked by Satan or something like that? I want to make it where when they put in a new password that the script will try to crack it and then accept it or make them enter a new one depending upon the outcome.

Thanks for the help.
Bob

[A. Clay Stephenson]

It's much, much easier to apply tests to the plaintext passwd before it is hashed. You might find it more useful to come up with a replacement for the passwd command. As a matter of fact, you could actually do every bit of it with Perl because it has functions to retrieve the passwd fields and also has crypt() which can be used to create the hash. There are also modules which will write the passwd entry back for you. Another approach is npasswd. Do a search for it. If you insist upon doing a test after the fact then your approach should be to feed crack with the hash and see how it fares.

[TheJuiceman]

Thanks!!! This sounds promising!!! Would you have any examples of how to go about this? Thanks again!!!

[Mic V. · Accepted solution]

It seems to me there was one in either of the books "Programming Perl" or "Learning Perl" several versions old. I'll post again if I can find it online.

Mic

[Mic V.]

Duh, should have just kept looking a little longer. Of course, posting the previous message made it pop up in the search engine. :-) Check out "anlpasswd" at:

http://www.kitetoa.com/_Export/Security_tools_1.html

It sounds like what you're looking for.

HTH,
Mic

[TheJuiceman]

Hey Mic,

This sounds perfect!!! Are there any "gotchas" on HP-UX 11.11 that you know of?

Thanks
Bobby

[Mic V.]

Not that I'm aware of! :-) Would you post your success story? I'm curious.

Mic

[TheJuiceman]

Absolutely!!! I will begin work on it and let you know!!! Thanks for the help!!!