| 1 | .TH PWDAUTH
|
|---|
| 2 | .SH NAME
|
|---|
| 3 | pwdauth \- password authentication program
|
|---|
| 4 | .SH SYNOPSIS
|
|---|
| 5 | .B /usr/lib/pwdauth
|
|---|
| 6 | .SH DESCRIPTION
|
|---|
| 7 | .B Pwdauth
|
|---|
| 8 | is a program that is used by the
|
|---|
| 9 | .BR crypt (3)
|
|---|
| 10 | function to do the hard work. It is a setuid root utility so that it is
|
|---|
| 11 | able to read the shadow password file.
|
|---|
| 12 | .PP
|
|---|
| 13 | .B Pwdauth
|
|---|
| 14 | expects on standard input two null terminated strings, the
|
|---|
| 15 | password typed by the user, and the salt. That is, the two arguments of
|
|---|
| 16 | the
|
|---|
| 17 | .B crypt
|
|---|
| 18 | function. The input read in a single read call must be 1024 characters or
|
|---|
| 19 | less including the nulls.
|
|---|
| 20 | .B Pwdauth
|
|---|
| 21 | takes one of two actions depending on the salt.
|
|---|
| 22 | .PP
|
|---|
| 23 | If the salt has the form "\fB##\fIuser\fR" then the
|
|---|
| 24 | .I user
|
|---|
| 25 | is used to index the shadow password file to obtain the encrypted password.
|
|---|
| 26 | The input password is encrypted with the one-way encryption function
|
|---|
| 27 | contained within
|
|---|
| 28 | .B pwdauth
|
|---|
| 29 | and compared to the encrypted password from the shadow password file. If
|
|---|
| 30 | equal then
|
|---|
| 31 | .B pwdauth
|
|---|
| 32 | returns the string "\fB##\fIuser\fR" with exit code 0, otherwise exit
|
|---|
| 33 | code 2 to signal failure. The string "\fB##\fIuser\fR" is also returned
|
|---|
| 34 | if both the shadow password and the input password are null strings to
|
|---|
| 35 | allow a password-less login.
|
|---|
| 36 | .PP
|
|---|
| 37 | If the salt is not of the form "\fB##\fIuser\fR" then the password is
|
|---|
| 38 | encrypted and the result of the encryption is returned. If salt and
|
|---|
| 39 | password are null strings then a null string is returned.
|
|---|
| 40 | .PP
|
|---|
| 41 | The return value is written to standard output as a null terminated string
|
|---|
| 42 | of 1024 characters or less including the null.
|
|---|
| 43 | .PP
|
|---|
| 44 | The exit code is 1 on any error.
|
|---|
| 45 | .SH "SEE ALSO"
|
|---|
| 46 | .BR crypt (3),
|
|---|
| 47 | .BR passwd (5).
|
|---|
| 48 | .SH NOTES
|
|---|
| 49 | A password must be checked like in this example:
|
|---|
| 50 | .PP
|
|---|
| 51 | .RS
|
|---|
| 52 | pw_ok = (strcmp(crypt(key, pw->pw_passwd), pw->pw_passwd) == 0);
|
|---|
| 53 | .RE
|
|---|
| 54 | .PP
|
|---|
| 55 | The second argument of crypt must be the entire encrypted password and
|
|---|
| 56 | not just the two character salt.
|
|---|
| 57 | .SH AUTHOR
|
|---|
| 58 | Kees J. Bot (kjb@cs.vu.nl)
|
|---|
