• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 500
  • Last Modified:

Reading encrypted passwords from a file using Perl

I've written a script in Perl that connects to an external FTP server and an internal LDAP server and in both cases a password is required for the user account used to access. I would like to be able to read an encrypted password from some file but cannot seem to find an answer.

It looks like it might be possible for me to use the Crypt library but I'm unsure of the best way to do this or what branch of libcrypt to use. Does anyone know if there are there benefits of using passwdmd5 over simple?

Thanks in advance.
0
coanda
Asked:
coanda
  • 5
  • 4
1 Solution
 
jeromeeCommented:
Coanda,
I'm not sure which mechanism was used to crypt those passwords but typically you can not decrypt passwords.
Instead, what authentication systems do, they encrypt the password that is presented and compare in to the already encrypted password that has been saved in the system (database, file, etc...).
If both encrypted passwords match, that means that they are identical and the user in authenticated.

My point again is that you can't really decrypt passwords... you can "crack" them (i.e. guess what they might be) by using brute force but that's another story in itself.

Good luck!
0
 
coandaAuthor Commented:
I understand what you're saying, but I don't understand why I wouldn't be able to recreate my password if I have the data that was output using crypt initially and the salt that was used to generate it.

Here's what I was kind of expecting to be able to do

1 - create password file

#!/usr/bin/env perl

@vars = getpwnam("DOMAIN\\Administrator");
open(FH, ">>passwd.ldap");
# use uid to salt
print FH crypt("password", $vars[2]);
close(FH);

2 - use password file

#!/usr/bin/env perl

@vars = getpwnam("DOMAIN\\Administrator");
open(FH, "passwd.ldap");
@data = <FH>;
$pass = decrypt($data[0], $vars[2]);
# continue to use password
# ...

---------

Hence the question, I don't actually care whether or not the answer involves crypt, if there's something else that's likely to work I'd be interested in hearing about it.
0
 
jeromeeCommented:
Here's more detail from the Perl crypt function...
     crypt PLAINTEXT,SALT
             Creates a digest string exactly like the crypt(3)
             function in the C library (assuming that you
             actually have a version there that has not been
             extirpated as a potential munitions).

             crypt() is a one-way hash function.  The PLAINTEXT
             and SALT is turned into a short string, called a
             digest, which is returned.  The same PLAINTEXT and
             SALT will always return the same string, but there
             is no (known) way to get the original PLAINTEXT from
             the hash.  Small changes in the PLAINTEXT or SALT
             will result in large changes in the digest.

             There is no decrypt function.  This function isn't
                         ^^^^^^^^^^^^^^^^^^^^^^^
             all that useful for cryptography (for that, look for
             Crypt modules on your nearby CPAN mirror) and the
             name "crypt" is a bit of a misnomer.  Instead it is
             primarily used to check if two pieces of text are
             the same without having to transmit or store the
             text itself.  An example is checking if a correct
             password is given.  The digest of the password is
             stored, not the password itself.  The user types in
             a password that is crypt()'d with the same salt as
             the stored digest.  If the two digests match the
             password is correct.
0
Who's Defending Your Organization from Threats?

Protecting against advanced threats requires an IT dream team – a well-oiled machine of people and solutions working together to defend your organization. Download our resource kit today to learn more about the tools you need to build you IT Dream Team!

 
coandaAuthor Commented:
As I stated in my previous post, I don't care whether or not crypt is used. I'm just trying to find a way, any way, to use an auth file that isn't plain text like the one used for example in Samba's approach.

But I'm starting to think that this isn't as easy as I'd originally assumed.
0
 
jeromeeCommented:
coanda,
If you are trying to build a file of logins and associated encrypted password to be later use by an application such as Samba to authenticate a user, I think it's possible as long as the source of the login/encrypted_password uses the same method of encryption as the authenticating application.
For example, I have done this using the UNIX's /etc/passwd to create an Apache's .htpasswd password file.
0
 
coandaAuthor Commented:
I've written a script that connects to my LDAP server and would like to avoid leaving an administrative account password as plain text in the script. It's looking like it would be easier to create a limited user capable of running LDAP queries.
0
 
jeromeeCommented:
You could just make your script readable to you only...

Or obfuscate it a bit:
% perl -e 'print pack "u", "my_passwd"'
);7E?<&%S<W=D

Then, in your script use soemthing like:
     my $p = unpack "u", ");7E?<&%S<W=D";      # note that the encrypted string is the same as above

For more heavy duty stuff you could try: http://search.cpan.org/~lds/Crypt-CBC-2.22/CBC.pm

Good luck!


0
 
coandaAuthor Commented:
Good enough for me. Thanks.
0
 
jeromeeCommented:
Thanks coanda!
And good luck with your project.
0

Featured Post

[Webinar On Demand] Database Backup and Recovery

Does your company store data on premises, off site, in the cloud, or a combination of these? If you answered “yes”, you need a data backup recovery plan that fits each and every platform. Watch now as as Percona teaches us how to build agile data backup recovery plan.

  • 5
  • 4
Tackle projects and never again get stuck behind a technical roadblock.
Join Now