Solved

Reading encrypted passwords from a file using Perl

Posted on 2010-09-13
9
446 Views
Last Modified: 2012-05-10
I've written a script in Perl that connects to an external FTP server and an internal LDAP server and in both cases a password is required for the user account used to access. I would like to be able to read an encrypted password from some file but cannot seem to find an answer.

It looks like it might be possible for me to use the Crypt library but I'm unsure of the best way to do this or what branch of libcrypt to use. Does anyone know if there are there benefits of using passwdmd5 over simple?

Thanks in advance.
0
Comment
Question by:coanda
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
9 Comments
 
LVL 10

Expert Comment

by:jeromee
ID: 33665858
Coanda,
I'm not sure which mechanism was used to crypt those passwords but typically you can not decrypt passwords.
Instead, what authentication systems do, they encrypt the password that is presented and compare in to the already encrypted password that has been saved in the system (database, file, etc...).
If both encrypted passwords match, that means that they are identical and the user in authenticated.

My point again is that you can't really decrypt passwords... you can "crack" them (i.e. guess what they might be) by using brute force but that's another story in itself.

Good luck!
0
 
LVL 3

Author Comment

by:coanda
ID: 33666998
I understand what you're saying, but I don't understand why I wouldn't be able to recreate my password if I have the data that was output using crypt initially and the salt that was used to generate it.

Here's what I was kind of expecting to be able to do

1 - create password file

#!/usr/bin/env perl

@vars = getpwnam("DOMAIN\\Administrator");
open(FH, ">>passwd.ldap");
# use uid to salt
print FH crypt("password", $vars[2]);
close(FH);

2 - use password file

#!/usr/bin/env perl

@vars = getpwnam("DOMAIN\\Administrator");
open(FH, "passwd.ldap");
@data = <FH>;
$pass = decrypt($data[0], $vars[2]);
# continue to use password
# ...

---------

Hence the question, I don't actually care whether or not the answer involves crypt, if there's something else that's likely to work I'd be interested in hearing about it.
0
 
LVL 10

Expert Comment

by:jeromee
ID: 33667301
Here's more detail from the Perl crypt function...
     crypt PLAINTEXT,SALT
             Creates a digest string exactly like the crypt(3)
             function in the C library (assuming that you
             actually have a version there that has not been
             extirpated as a potential munitions).

             crypt() is a one-way hash function.  The PLAINTEXT
             and SALT is turned into a short string, called a
             digest, which is returned.  The same PLAINTEXT and
             SALT will always return the same string, but there
             is no (known) way to get the original PLAINTEXT from
             the hash.  Small changes in the PLAINTEXT or SALT
             will result in large changes in the digest.

             There is no decrypt function.  This function isn't
                         ^^^^^^^^^^^^^^^^^^^^^^^
             all that useful for cryptography (for that, look for
             Crypt modules on your nearby CPAN mirror) and the
             name "crypt" is a bit of a misnomer.  Instead it is
             primarily used to check if two pieces of text are
             the same without having to transmit or store the
             text itself.  An example is checking if a correct
             password is given.  The digest of the password is
             stored, not the password itself.  The user types in
             a password that is crypt()'d with the same salt as
             the stored digest.  If the two digests match the
             password is correct.
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 3

Author Comment

by:coanda
ID: 33667471
As I stated in my previous post, I don't care whether or not crypt is used. I'm just trying to find a way, any way, to use an auth file that isn't plain text like the one used for example in Samba's approach.

But I'm starting to think that this isn't as easy as I'd originally assumed.
0
 
LVL 10

Expert Comment

by:jeromee
ID: 33667599
coanda,
If you are trying to build a file of logins and associated encrypted password to be later use by an application such as Samba to authenticate a user, I think it's possible as long as the source of the login/encrypted_password uses the same method of encryption as the authenticating application.
For example, I have done this using the UNIX's /etc/passwd to create an Apache's .htpasswd password file.
0
 
LVL 3

Author Comment

by:coanda
ID: 33668191
I've written a script that connects to my LDAP server and would like to avoid leaving an administrative account password as plain text in the script. It's looking like it would be easier to create a limited user capable of running LDAP queries.
0
 
LVL 10

Accepted Solution

by:
jeromee earned 500 total points
ID: 33673378
You could just make your script readable to you only...

Or obfuscate it a bit:
% perl -e 'print pack "u", "my_passwd"'
);7E?<&%S<W=D

Then, in your script use soemthing like:
     my $p = unpack "u", ");7E?<&%S<W=D";      # note that the encrypted string is the same as above

For more heavy duty stuff you could try: http://search.cpan.org/~lds/Crypt-CBC-2.22/CBC.pm

Good luck!


0
 
LVL 3

Author Closing Comment

by:coanda
ID: 33675347
Good enough for me. Thanks.
0
 
LVL 10

Expert Comment

by:jeromee
ID: 33675549
Thanks coanda!
And good luck with your project.
0

Featured Post

Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In the distant past (last year) I hacked together a little toy that would allow a couple of Manager types to query, preview, and extract data from a number of MongoDB instances, to their tool of choice: Excel (http://dilbert.com/strips/comic/2007-08…
The purpose of this article is to fix the unknown display problem in Linux Mint operating system. After installing the OS if you see Display monitor is not recognized then we can install "MESA" utilities to fix this problem or we can install additio…
Explain concepts important to validation of email addresses with regular expressions. Applies to most languages/tools that uses regular expressions. Consider email address RFCs: Look at HTML5 form input element (with type=email) regex pattern: T…

738 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question