2

Application is for a multiple server standardization script

Looking for a way in a shell script to check if the password for an OS account (AIX) matches a standardized plain text password.

The catch is that there is no root access, no c compiler or python , and I cannot install any additional software including expect.

So far I have not been able to find a solution...any ideas?

  • Sounds like a bad idea...that means you have a clear-text list of every user's password, which you will want to keep in sync with whatever is being used for the OS authentication? It sounds like what you really want to do is to authenticate users against (some) existing service. You didn't say if the OS is authenticating against LDAP/NIS/etc-passwd or ssh public key authentication or...? Or, will your script passwd differ from the OS passwd? (Otherwise, obviously, if the user is logged-in, you can assume they are authenticated and there is no need to re-authenticate.) – michael Jun 19 '13 at 1:19
  • A non-root user cannot read an OS account's password, so I'm not sure there is a solution. – Jeff Schaller Jun 8 '15 at 13:51
1

I'm going to go out on a limb and elevate my previous comment to an Answer. Without root access, and without breaking the default security of the AIX system (by opening the password file up to non-root users), non-root users cannot read the encrypted password file, therefore non-root users would not be able to compare any password to the existing one.

The best option I can imagine is to attempt a login with the account and assumed password, then check the results. If you're running locally to the system, you could telnet or ssh to localhost; if you're remote, you'd be limited to whatever external login methods are running (e.g. ssh). Wrap the login process with perl or expect and see if it worked. (If you cannot install such tools on the AIX system itself, then use or install them from a remote system). One minor down-side to this approach is that if your password is not correct, it would increase the failed login attempt by one for that user. Doing so probably will not cause a lockout of the account, but it's something to be aware of.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.