Solved

Reading encrypted passwords from a file using Perl

Posted on 2010-09-13
9
444 Views
Last Modified: 2012-05-10
I've written a script in Perl that connects to an external FTP server and an internal LDAP server and in both cases a password is required for the user account used to access. I would like to be able to read an encrypted password from some file but cannot seem to find an answer.

It looks like it might be possible for me to use the Crypt library but I'm unsure of the best way to do this or what branch of libcrypt to use. Does anyone know if there are there benefits of using passwdmd5 over simple?

Thanks in advance.
0
Comment
Question by:coanda
  • 5
  • 4
9 Comments
 
LVL 10

Expert Comment

by:jeromee
ID: 33665858
Coanda,
I'm not sure which mechanism was used to crypt those passwords but typically you can not decrypt passwords.
Instead, what authentication systems do, they encrypt the password that is presented and compare in to the already encrypted password that has been saved in the system (database, file, etc...).
If both encrypted passwords match, that means that they are identical and the user in authenticated.

My point again is that you can't really decrypt passwords... you can "crack" them (i.e. guess what they might be) by using brute force but that's another story in itself.

Good luck!
0
 
LVL 3

Author Comment

by:coanda
ID: 33666998
I understand what you're saying, but I don't understand why I wouldn't be able to recreate my password if I have the data that was output using crypt initially and the salt that was used to generate it.

Here's what I was kind of expecting to be able to do

1 - create password file

#!/usr/bin/env perl

@vars = getpwnam("DOMAIN\\Administrator");
open(FH, ">>passwd.ldap");
# use uid to salt
print FH crypt("password", $vars[2]);
close(FH);

2 - use password file

#!/usr/bin/env perl

@vars = getpwnam("DOMAIN\\Administrator");
open(FH, "passwd.ldap");
@data = <FH>;
$pass = decrypt($data[0], $vars[2]);
# continue to use password
# ...

---------

Hence the question, I don't actually care whether or not the answer involves crypt, if there's something else that's likely to work I'd be interested in hearing about it.
0
 
LVL 10

Expert Comment

by:jeromee
ID: 33667301
Here's more detail from the Perl crypt function...
     crypt PLAINTEXT,SALT
             Creates a digest string exactly like the crypt(3)
             function in the C library (assuming that you
             actually have a version there that has not been
             extirpated as a potential munitions).

             crypt() is a one-way hash function.  The PLAINTEXT
             and SALT is turned into a short string, called a
             digest, which is returned.  The same PLAINTEXT and
             SALT will always return the same string, but there
             is no (known) way to get the original PLAINTEXT from
             the hash.  Small changes in the PLAINTEXT or SALT
             will result in large changes in the digest.

             There is no decrypt function.  This function isn't
                         ^^^^^^^^^^^^^^^^^^^^^^^
             all that useful for cryptography (for that, look for
             Crypt modules on your nearby CPAN mirror) and the
             name "crypt" is a bit of a misnomer.  Instead it is
             primarily used to check if two pieces of text are
             the same without having to transmit or store the
             text itself.  An example is checking if a correct
             password is given.  The digest of the password is
             stored, not the password itself.  The user types in
             a password that is crypt()'d with the same salt as
             the stored digest.  If the two digests match the
             password is correct.
0
NEW Veeam Agent for Microsoft Windows

Backup and recover physical and cloud-based servers and workstations, as well as endpoint devices that belong to remote users. Avoid downtime and data loss quickly and easily for Windows-based physical or public cloud-based workloads!

 
LVL 3

Author Comment

by:coanda
ID: 33667471
As I stated in my previous post, I don't care whether or not crypt is used. I'm just trying to find a way, any way, to use an auth file that isn't plain text like the one used for example in Samba's approach.

But I'm starting to think that this isn't as easy as I'd originally assumed.
0
 
LVL 10

Expert Comment

by:jeromee
ID: 33667599
coanda,
If you are trying to build a file of logins and associated encrypted password to be later use by an application such as Samba to authenticate a user, I think it's possible as long as the source of the login/encrypted_password uses the same method of encryption as the authenticating application.
For example, I have done this using the UNIX's /etc/passwd to create an Apache's .htpasswd password file.
0
 
LVL 3

Author Comment

by:coanda
ID: 33668191
I've written a script that connects to my LDAP server and would like to avoid leaving an administrative account password as plain text in the script. It's looking like it would be easier to create a limited user capable of running LDAP queries.
0
 
LVL 10

Accepted Solution

by:
jeromee earned 500 total points
ID: 33673378
You could just make your script readable to you only...

Or obfuscate it a bit:
% perl -e 'print pack "u", "my_passwd"'
);7E?<&%S<W=D

Then, in your script use soemthing like:
     my $p = unpack "u", ");7E?<&%S<W=D";      # note that the encrypted string is the same as above

For more heavy duty stuff you could try: http://search.cpan.org/~lds/Crypt-CBC-2.22/CBC.pm

Good luck!


0
 
LVL 3

Author Closing Comment

by:coanda
ID: 33675347
Good enough for me. Thanks.
0
 
LVL 10

Expert Comment

by:jeromee
ID: 33675549
Thanks coanda!
And good luck with your project.
0

Featured Post

Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Unix / Linux grid computing 5 169
Perl modules on linux ec2 3 123
linux service nerwork restart throwing eth1 not dound? 5 88
Encrypted Laptop running Linux 3 132
I've just discovered very important differences between Windows an Unix formats in Perl,at least 5.xx.. MOST IMPORTANT: Use Unix file format while saving Your script. otherwise it will have ^M s or smth likely weird in the EOL, Then DO NOT use m…
Have you ever been frustrated by having to click seven times in order to retrieve a small bit of information from the web, always the same seven clicks, scrolling down and down until you reach your target? When you know the benefits of the command l…
Explain concepts important to validation of email addresses with regular expressions. Applies to most languages/tools that uses regular expressions. Consider email address RFCs: Look at HTML5 form input element (with type=email) regex pattern: T…

756 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question