emo/shadow
1
0
Fork 0
Code Issues Pull Requests Packages Releases Activity

Add support for SHA256 and SHA512 encrypt methods. Apply RedHat's patch

Browse Source 
shadow-4.0.18.1-sha256.patch. Thanks to Peter Vrabec. Hardly no changes
except re-indent and changes related to recent modifications (max_salt_len
in crypt_make_salt). Changes in lib/defines.h not applied (definition of
ENCRYPTMETHOD_SELECT). I will add a configure check or flag.
This commit is contained in:
nekral-guest
2007-11-19 22:14:19 +00:00
parent cfc3378a0b
commit b8d8d0de00
7 changed files with 102 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
libmisc/obscure.c
View File

@@ -210,6 +210,9 @@ static const char *password_check (const char *old, const char *new,
int maxlen, oldlen, newlen;
char *new1, *old1;
const char *msg;
#ifdef ENCRYPTMETHOD_SELECT
char *result;
#endif
oldlen = strlen (old);
newlen = strlen (new);
@@ -227,15 +230,28 @@ static const char *password_check (const char *old, const char *new,
if (msg)
return msg;
#ifdef ENCRYPTMETHOD_SELECT
if ((result = getdef_str ("ENCRYPT_METHOD")) == NULL) {
#endif
/* The traditional crypt() truncates passwords to 8 chars. It is
possible to circumvent the above checks by choosing an easy
8-char password and adding some random characters to it...
Example: "password$%^&*123". So check it again, this time
truncated to the maximum length. Idea from npasswd. --marekm */
if (getdef_bool ("MD5_CRYPT_ENAB"))
return NULL; /* unlimited password length */
if (getdef_bool ("MD5_CRYPT_ENAB"))
return NULL;
#ifdef ENCRYPTMETHOD_SELECT
} else {
if (!strncmp (result, "MD5" , 3) ||
!strncmp (result, "SHA256", 6) ||
!strncmp (result, "SHA512", 6))
return NULL;
}
#endif
maxlen = getdef_num ("PASS_MAX_LEN", 8);
if (oldlen <= maxlen && newlen <= maxlen)
return NULL;

34
libmisc/salt.c
View File

@@ -58,20 +58,44 @@ char *l64a(long value)
* (magic) and pw_encrypt() will execute the MD5-based FreeBSD-compatible
* version of crypt() instead of the standard one.
*/
#define MAGNUM(array,ch) (array)[0]= (array)[2] = '$',(array)[1]=(ch)
char *crypt_make_salt (void)
{
struct timeval tv;
static char result[40];
int max_salt_len = 8;
char *method;
result[0] = '\0';
#ifndef USE_PAM
if (getdef_bool ("MD5_CRYPT_ENAB")) {
strcpy (result, "$1$"); /* magic for the new MD5 crypt() */
max_salt_len += 3;
}
#ifdef ENCRYPTMETHOD_SELECT
if ((method = getdef_str ("ENCRYPT_METHOD")) == NULL) {
#endif
if (getdef_bool ("MD5_CRYPT_ENAB")) {
MAGNUM(result,'1');
max_salt_len = 11;
} else
result[0] = '\0';
#ifdef ENCRYPTMETHOD_SELECT
} else {
if (!strncmp (method, "MD5", 3)) {
MAGNUM(result, '1');
max_salt_len = 11;
} else if (!strncmp (method, "SHA256", 6)) {
MAGNUM(result, '5');
max_salt_len = 11; /* XXX: should not be fixed */
} else if (!strncmp (method, "SHA512", 6)) {
MAGNUM(result, '6');
max_salt_len = 11; /* XXX: should not be fixed */
} else if (!strncmp (method, "DES", 3))
result[0] = '\0';
else
result[0] = '\0';
}
#endif /* ENCRYPTMETHOD_SELECT */
#endif /* USE_PAM */
/*
* Generate 8 chars of salt, the old crypt() will use only first 2.
*/