3

I'm doing a gui tool for some malware detection script in linux to let server administrators to analyse the result of this script within the web.

as I know the encryption used in /etc/shadow is strong, I would like to use the same password in root in my app and check for the changes within /etc/shadow and sync the root password in db and allow the admin to login using root credentials.

I am going to develop this in PHP. I wanted to know what encryption is exactly being used in this and is that possible to implement the same thing in php so in result I can be able to let people login with root credentials to my gui in php?

2

The value in the password field either starts with $XY$ where X is a number or is one of two DES (Standard or Extended, depending on the length).

DES is seldom supported, because it is no longer secure. The Y is optional depending on the X designates the following (after the second $):

1: CRYPT_MD5 ( Y empty)
2: CRYPT_BLOWFISH ( Y can be a, x or y )
5: CRYPT_SHA256 6: CRYPT_SHA512

You are most likely to encounter the $6$ nowadays and the calculation is done based on repeatedly (standard 5000 times) applying res = sha(res + salt) starting with res = password. The salt follows the second $ up to a third $ unless there is a different number of rounds can be specified as well and then it is stored before the salt:

$6$salt$result
$6$rounds=N$salt$result

(where the first one implies 5000 rounds).

You can of course implement this yourself, but I would check whether PHP's crypt supports specifying the algorithm to use, or otherwise look at calling mkpasswd (e.g. in the one in whois package on Ubuntu)


Given that that all that works, I recommend not using the root account and password for this not even over HTTPS. If your PHP is compromised, injecting something that then snoops the root password for the system would be very easy.

  • thank you very much. i'm doing this as my final year project, I'm going to give some capability of malware detection control over php interface but i'll take note of the security concern you mentioned. – Hector Nov 9 '14 at 12:47
  • @Hector Thanks in comments are not necessary. If you feel any of the answers here answers your question, please consider accepting it, so others know that that was the (best) solution for you. In addition you can (since you have 16 rep) upvote any helpful answer possibly including the one you mark as "accepted". Good luck with your project. – Anthon Nov 9 '14 at 12:58
1

I can be able to let people login with root credentials to my gui in php?

If you mean the GUI process has root credentials, then yes. That is a requirement. passwd and other things that do this have the setuid bit set and are owned by root. For instructions on how to do this with php see here.

First to make sure a basic fact about passwords is clear -- I think you probably already know this but: Passwords are not stored in the system. A one way hash of them is. A one way hash is a string that can be created using an encryption algorithm from a source string (e.g., an actual password) but the source cannot be recreated from the hash.

This means even if someone gets hold of /etc/shadow, there's no way for them to reconstruct user passwords. The encryption is one way, it cannot be reversed. However, you can take a string, encrypt it the same way, and compare it to the hash. This is how password authentication happens.

The structure of the hash string in /etc/shadow is explained in Anthon's good answer. Below is the basic process of authentication demonstrated in C. PHP has a wrapper for getpwnam() or you could parse and store /etc/shadow yourself. To understand what crypt() does with the string (as Anthon mentions, it includes an indication of the algorithm used and the "salt" for creating the hash), see NOTES -> Glibc notes in man 3 crypt. PHP's crypt() appears to work the same way although the doc is less clear.

The only significant functions are getpwnam() and crypt(), everything else is just basic input, output, and string manipulation.

#define _XOPEN_SOURCE // Important.
#include <errno.h>
#include <crypt.h>
#include <shadow.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>

int main (int argc, const char *argv[]) {
    if (argc < 2) {
        puts("Username required.");
        return 1;
    }

// Get shadow password.
    struct spwd *spw = getspnam(argv[1]);
    if (!spw) {
        if (errno == EACCES) puts("Permission denied.");
        else if (!errno) puts("No such user.");
        else puts(strerror(errno));
        return 1;
    }

// Read password from user.
    fprintf(stderr, "%s> ", argv[1]);
    char buffer[4096];
    int len = read(0, buffer, 4095);
    // Ditch the newline.
    buffer[len - 1] = '\0';

// Hash and report.
    char *hashed = crypt(buffer, spw->sp_pwdp);
    printf("%s\n%s\n", spw->sp_pwdp, hashed);
    if (!strcmp(spw->sp_pwdp, hashed)) puts("Password matched.");
    else puts("Password DID NOT match.");

    return 0;
} 

You can compile this:

gcc --std=c99 whatever.c -o testpw -lcrypt

You need to run it as root or you will get "Permission denied." You need to specify a real username:

./testpw me

Note echo is not disabled so the password will be visible when you type it.

0

For the structure of /etc/shadow look at http://www.cyberciti.biz/faq/understanding-etcshadow-file/ as for the encryption, I'm pretty sure linux uses Crypt algorithm (see http://linux.die.net/man/3/crypt and http://php.net/manual/en/function.crypt.php)

  • Welcome to Unix & Linux Stack Exchange! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – slm Nov 8 '14 at 14:39
0

Passwords are not encrypted. They are hashed with a salt.

The format used in /etc/passwd or /etc/shadow supports a wide range of different hash algorithms by having an algorithm specification as part of the string. Both the generation of the hashed string and verification is done using the crypt function, which automatically picks the appropriate algorithm based on the input string.

There is a crypt function in php, but for your use case I would not recommend using it.

Running code on a web server with root privileges is extremely dangerous. It takes only one minor mistake before your system is vulnerable to attacks.

Rather I recommend that your php script only gains root privileges by executing one of the standard suid utilities on the system, which can grant root privileges if they are given the root password. The su command might be the most suitable for you.

If the system was configured such that the hashed root password is stored in /etc/passwd, then your script could read it and use crypt to validate the password entered by the user. But there is not much reason to do this, and it will not work, if /etc/shadow is used. Instead just pass whatever password the user entered to su and learn from the response from su whether the password was correct.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.