4

Looking for a way in a shell script to validate the password for for root on an (AIX) matches a standardized plain text password. This query is similar to another one on this site. I have access to root and can compile a c Program if needed. I have been abel to find standard libraries to do this for HP-UX and Linux. Now I am working on AIX and I have been hitting nothing but road blocks. I have been able to extract the salt and the hash and I know the plain text password. I am wanting to input the salt and password and get back the password hash so the I can compare it to what is stored on the server.

2
  • Is there no libcrypt on AIX?
    – nohillside
    Aug 8, 2012 at 19:46
  • I did find /lib/libcrypt.a but I am not a c coder so I am not sure how to use it. I assume a header file might help but I have not found it. I am fairly new to AIX.
    – RLGJR
    Aug 8, 2012 at 20:34

1 Answer 1

1

I'm not familiar with AIX, there may be a dedicated tool for that. This tool is likely to need to run as root, though.

Rather than code it yourself, I recommend using existing tools. Pass the password to su and test whether su succeeds. Note that you'll have to run su as root. Since su reads the password from the terminal, you'll need to use Expect to pass it.

Here's a script inspired from cluelessCoder's on a similar question on Stack Overflow. Note that this script needs to run as a non-root user, otherwise su will not prompt for a password.

#!/bin/sh
PASSWORD=swordfish

expect << EOF
spawn su -c exit
expect "Password:"
send "$PASSWORD\r"
set wait_result  [wait]

# check if it is an OS error or a return code from our command
#   index 2 should be -1 for OS erro, 0 for command return code
if {[lindex \$wait_result 2] == 0} {
        exit [lindex \$wait_result 3]
} 
else {
        exit 1 
}
EOF
if [ $? -eq 0 ]; then
  echo "The password is correct"
else
  echo "The password is wrong"
fi

If you have Perl, or if you want to use a C program, see this answer to a similar question which shows how to extract the password hash and compute a hash of the supplied password with the same salt, under Linux. You may need to adjust the hash extraction if your system uses the traditional DES scheme.

5
  • I can not use expect as this is not normaly available or installed on AIX servers. I have extracted the password hash and salt. What I have not found on the AIX servers is the crypt library that would allow me to use the salt and plain text password to caculate the hash. AIX like a lot of older UNIX flavors still use crypt based on the normal DES hashing scheme.
    – RLGJR
    Aug 9, 2012 at 20:06
  • @RLGJR crypt(3) is a POSIX function, so it should be available on AIX. Is there a c89 command? Does it find crypt()? Aug 9, 2012 at 20:12
  • @RLGJR This C code snippet may help. Aug 9, 2012 at 22:14
  • I do have c89 on one server and the code snippet looks useful. I will see if I can get it to do what I want.
    – RLGJR
    Aug 13, 2012 at 13:58
  • 1
    Gilles thank you for your help. Your answers led me to what I was looking for. In some of the othe older nix they use either crypt or bigcrypt and I was able to find libraries via the man pages. With AIX could not find it even when I attempted the find command. The C code snippet showed me where the libraries were stored. With that I was abel to write this small C program: #include <stdio.h> #include <crypt.h> / 1st param is the desired password / / 2nd param is 2 char salt */ main(argc,argv) int argc; char *argv[]; { char *p; p=crypt(argv[1],argv[2]); printf("%s",p); }
    – RLGJR
    Aug 13, 2012 at 14:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .