Suppose I've writen a setuid root executable and I want it to verify that the user is not a script by asking the user to provide his/her password (granted, users might save their password and use that in a script, but that doesn't concern me).

What would be a good way to do this? The more portable the better.

  • perhaps checking the Stdin/stdout whether its attached to terminal [ -t 0 ] – heemayl Aug 3 '15 at 13:07
  • Don't you want to pull authentication to apropriate level, do it in unix way: let script alone and configure 'sudo' or similar tool? – paul Aug 3 '15 at 13:08
  • @paul I don't want to needlessly make users into sudoers. All I want is to have them verify themselves (with their password) for my app. – PSkocik Aug 3 '15 at 13:20
  • 1
    @PSkocik sudo is very flexible, you'll register your program and allow everyone to run it requiring password. You don't allow users to be root in this way. – paul Aug 3 '15 at 13:22
  • Thanks then. I'll go read the manual. If you've got a code snippet that solves the problem right away, I've got 25 points going your way. ;) – PSkocik Aug 3 '15 at 13:37

Most modern Unix systems use PAM to handle authentication. The pam_unix module is the one that does password authentication against /etc/password and /etc/shadow.

However, you shouldn't reinvent the wheel. Asking for the user's password and running as root is a basic configuration of sudo, the de facto standard way to elevate privileges. Note that properly elevating privileges is tricky: did you remember to purge all environment variables that could affect your program? Sudo takes pains to do it safely.

To allow user alice to run /usr/local/bin/myprogram as root with any arguments of her choice after typing her password, use the following line in the sudoers file (the sudo configuration file):

alice ALL = (root) /usr/local/bin/myprogram

To edit the sudoers file, run the command visudo.

Alice will have to run sudo myprogram. If you want her to be able to type just the program name, hide this in a wrapper script. But note that Alice may prefer to run something like gksudo myprogram to get a GUI prompt.

Many variations are possible, including forbidding the caller from passing arguments:

alice ALL = (root) /usr/local/bin/myprogram ""

or applying the entry to a group:

%mygroup ALL = (root) /usr/local/bin/myprogram

If your program needs to know who invoked it, sudo makes that available in the environment variables SUDO_UID and SUDO_USER.


I was looking for something like this


hash=$(sudo cat /etc/shadow |grep "^$USER:" |cut -d: -f2) 
cmphash=$(mkpasswd -m sha-512 -S "$(echo "$hash" | cut -d '$' -f3)")
cmp <(echo "$hash") <(echo "$cmphash") && echo "Correct password!"

This works but harcodes the hash method which somehow identified by the number in echo "$hash" | cut -d '$' -f2 which is 6 in this case. I have yet to figure out how to map the number to the hash method.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.