Solved

Reading encrypted passwords from a file using Perl

Posted on 2010-09-13
9
423 Views
Last Modified: 2012-05-10
I've written a script in Perl that connects to an external FTP server and an internal LDAP server and in both cases a password is required for the user account used to access. I would like to be able to read an encrypted password from some file but cannot seem to find an answer.

It looks like it might be possible for me to use the Crypt library but I'm unsure of the best way to do this or what branch of libcrypt to use. Does anyone know if there are there benefits of using passwdmd5 over simple?

Thanks in advance.
0
Comment
Question by:coanda
  • 5
  • 4
9 Comments
 
LVL 10

Expert Comment

by:jeromee
ID: 33665858
Coanda,
I'm not sure which mechanism was used to crypt those passwords but typically you can not decrypt passwords.
Instead, what authentication systems do, they encrypt the password that is presented and compare in to the already encrypted password that has been saved in the system (database, file, etc...).
If both encrypted passwords match, that means that they are identical and the user in authenticated.

My point again is that you can't really decrypt passwords... you can "crack" them (i.e. guess what they might be) by using brute force but that's another story in itself.

Good luck!
0
 
LVL 3

Author Comment

by:coanda
ID: 33666998
I understand what you're saying, but I don't understand why I wouldn't be able to recreate my password if I have the data that was output using crypt initially and the salt that was used to generate it.

Here's what I was kind of expecting to be able to do

1 - create password file

#!/usr/bin/env perl

@vars = getpwnam("DOMAIN\\Administrator");
open(FH, ">>passwd.ldap");
# use uid to salt
print FH crypt("password", $vars[2]);
close(FH);

2 - use password file

#!/usr/bin/env perl

@vars = getpwnam("DOMAIN\\Administrator");
open(FH, "passwd.ldap");
@data = <FH>;
$pass = decrypt($data[0], $vars[2]);
# continue to use password
# ...

---------

Hence the question, I don't actually care whether or not the answer involves crypt, if there's something else that's likely to work I'd be interested in hearing about it.
0
 
LVL 10

Expert Comment

by:jeromee
ID: 33667301
Here's more detail from the Perl crypt function...
     crypt PLAINTEXT,SALT
             Creates a digest string exactly like the crypt(3)
             function in the C library (assuming that you
             actually have a version there that has not been
             extirpated as a potential munitions).

             crypt() is a one-way hash function.  The PLAINTEXT
             and SALT is turned into a short string, called a
             digest, which is returned.  The same PLAINTEXT and
             SALT will always return the same string, but there
             is no (known) way to get the original PLAINTEXT from
             the hash.  Small changes in the PLAINTEXT or SALT
             will result in large changes in the digest.

             There is no decrypt function.  This function isn't
                         ^^^^^^^^^^^^^^^^^^^^^^^
             all that useful for cryptography (for that, look for
             Crypt modules on your nearby CPAN mirror) and the
             name "crypt" is a bit of a misnomer.  Instead it is
             primarily used to check if two pieces of text are
             the same without having to transmit or store the
             text itself.  An example is checking if a correct
             password is given.  The digest of the password is
             stored, not the password itself.  The user types in
             a password that is crypt()'d with the same salt as
             the stored digest.  If the two digests match the
             password is correct.
0
 
LVL 3

Author Comment

by:coanda
ID: 33667471
As I stated in my previous post, I don't care whether or not crypt is used. I'm just trying to find a way, any way, to use an auth file that isn't plain text like the one used for example in Samba's approach.

But I'm starting to think that this isn't as easy as I'd originally assumed.
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 10

Expert Comment

by:jeromee
ID: 33667599
coanda,
If you are trying to build a file of logins and associated encrypted password to be later use by an application such as Samba to authenticate a user, I think it's possible as long as the source of the login/encrypted_password uses the same method of encryption as the authenticating application.
For example, I have done this using the UNIX's /etc/passwd to create an Apache's .htpasswd password file.
0
 
LVL 3

Author Comment

by:coanda
ID: 33668191
I've written a script that connects to my LDAP server and would like to avoid leaving an administrative account password as plain text in the script. It's looking like it would be easier to create a limited user capable of running LDAP queries.
0
 
LVL 10

Accepted Solution

by:
jeromee earned 500 total points
ID: 33673378
You could just make your script readable to you only...

Or obfuscate it a bit:
% perl -e 'print pack "u", "my_passwd"'
);7E?<&%S<W=D

Then, in your script use soemthing like:
     my $p = unpack "u", ");7E?<&%S<W=D";      # note that the encrypted string is the same as above

For more heavy duty stuff you could try: http://search.cpan.org/~lds/Crypt-CBC-2.22/CBC.pm

Good luck!


0
 
LVL 3

Author Closing Comment

by:coanda
ID: 33675347
Good enough for me. Thanks.
0
 
LVL 10

Expert Comment

by:jeromee
ID: 33675549
Thanks coanda!
And good luck with your project.
0

Featured Post

Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
Strange perl issue 6 122
Ubuntu 16.04 Emergency Boot 2 149
what is this linux system is? 16 115
perl: Cleaning meta tags using RegEX 12 41
On Microsoft Windows, if  when you click or type the name of a .pl file, you get an error "is not recognized as an internal or external command, operable program or batch file", then this means you do not have the .pl file extension associated with …
BIND is the most widely used Name Server. A Name Server is the one that translates a site name to it's IP address. There is a new bug in BIND (https://kb.isc.org/article/AA-01272), affecting all versions of BIND 9 from BIND 9.1.0 (inclusive) thro…
Explain concepts important to validation of email addresses with regular expressions. Applies to most languages/tools that uses regular expressions. Consider email address RFCs: Look at HTML5 form input element (with type=email) regex pattern: T…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now