Wednesday, August 20, 2014

crypt function in Linux

Here is a function provided to encrypt a given key with a provided salt. The signature of the function is as follows:
 
char *crypt(const char *key, const char *salt);

 
If a salt given has a format of "$.$...$..." i.e. normally of the hashed password stored in shadow file (look for my previous blogs on shadow file), then the function will interpret the salt and get the type of hash to be used. A hash type could be of MD5 ($1$), SHA256 ($5$), etc. This way one can hash a password provided by a user (the argument 'key') and match/authenticate with the one stored in the shadow file. This function is highly recommended not to be used for any other purpose except authentication. Readers are recommended to go through its manual page and understand its usage. 
 
Here are some references:
man 3 crypt

gnu_libc_crypt
man7_crypt

Saturday, August 16, 2014

Linux shadow and passwd files - an introduction

A user's credentials and password related information are maintained in shadow file in Linux. The file requires root permission to be read. It has the following construction:

username : hashed passwd with salt and type : last passwd change day : minimun days to change passwd : max passwd lifetime : warning period : grace period : account expire day

Days above are in refernce to last passwd change day (calculated from epoch, 01/01/1970) and max passwd lifetime. They can be changed as required. In grace period, a user is asked to changed the passwd as soon as s/he logs in whereas in warning period, which is calculated from max passwd lifetime, the user is just thrown a warning message saying when the passwd will expire. The account lock day is the day after which the user is not allowed to login. There are several utilities which can be used with appropriate options to manipulate these entries in shadow file.

A passwd file is a file which stores user information. It has the following construction:

username : user id : group id :full name : home dir : shell

The last field, shell, is the default shell given to the user after login and home dir is its home directory.

The above words are used so as to convey the information. More information comes in a follow-up blog with references. 


Functions to get and set shadow and passwd file values

An introduction was given about the shadow and passwd files in linux in my last post. Here are some of the functions with their signatures which are provided to get/set values from/to these files:

struct spwd *getspnam (const char *name);

Following is the structure which gets populated if the user is present:

 struct spwd {
     char *sp_namp;
     char *sp_pwdp;
     long sp_lstchg;
     long sp_min;
     long sp_max;
     long sp_warn;
     long sp_inact;
     long sp_expire;
     unsigned long sp_flag;
};

Following are the functions which may be used to get entries one by one:

void setspent (void);
struct spwd *getspent (void);
void endspent (void);

Following function deals with passwd file entries:

struct passwd *getpwnam (const char *name);

It returns following structure:
 struct passwd {
     char *pw_name;
     char *pw_passwd;
     uid_t pw_uid;
     gid_t pw_gid;
     char *gecos;
     char *pw_dir;
     char *pw_shell;
};

An exhaustive explanation and lists of functions, their return values, header files to include, etc may be found in their manual pages i.e. man 3 getspnam, man 3 getpwnam, etc and the above definitions of structures and functions signatures are taken from these manual pages itself.