Shadow Passwords

Applications Programming
1

I'm writing a 'C' program on various systems (HP-UX, Solaris, AIX, NCR) which needs to interact with a user's password. Some of my systems are using the shadow password and some are not. It is possible for some of my systems to have /etc/shadow, even though the box is not using the file (I know, it doesn't make sense to me either).

My question: How can I tell, from a 'C' program, if the box is really using the /etc/shadow password file when someone logs in?

Thanks.

Chris

2

What library function are you using to get the passwd entries? Don't just read them using fgets or something. Use getpwent to iteratively read the entire file. getpwent returns a structure that holds the different fields. The second field in that is pw_passwd which holds the user's encrypted passwd.

To determine whether your system is using shadow files or is a trusted system, all you should do is verify that the pw_passwd string is not 13 chars or longer. If it is then you can use the trusted system calls to get the shadow entries. If not, you can use the current pw_passwd string as it does hold the encrypted password for the user.

3

Chris,

In my experience at work, our HP-UX systems don't shadow the password at all. NCR uses the /etc/shadow file, and I believe AIX uses /etc/security/passwd.

To answer your question: look at the 2nd field in /etc/passwd. If it's a '*' or a 'x' character for every user, it is probably using a shadowed password file. So I would use getpwent() as suggested above, and use strlen() to determine the length of the pw_passwd field. If it's greater than say, 5 characters, they are probably not using a shadow file.

Oh, and it seems that you and I may work for the same corporation. If you turn on private messaging, I may be able to help you more with this.

Thanks,
Nathan

4

You can download a shadow password package for HP-UX 11i here: HP-UX Shadow Passwords. Shadow passwords are a standard feature starting with HP-UX 11i Version 2 as mentioned in the Release Notes.

5

Chris,
If you want to actually work with the user's password information, you can use the getspent library function. This reads from the trusted computing base or the shadow files as is fit for the system. I have used this on HP-UX and Solaris. You could try it on other systems.

Cheers.