Getting started with Linux programming-crypt

Crypt is a cryptographic function based on the Data Encryption Standard (DES) algorithm.
Crypt is basically one way encryption. Therefore, crypt is applicable only to passwords and not to data encryption.
Char * crypt (const char * Key, const char * salt );
The key is the user's password. Salt is two words, each word can be selected from [a-zA-Z0-9./], because the same password adds 4096 possibilities. Obtain the 56-bit keyword by using the lower seven-bit yuan of each word in the key. These 56-bit keywords are used to encrypt a group of words, this group contains 13 printable ASCII characters, including the first two salts.
Crypt is used when you have self-managed users, such as member websites and BBs.
Example 1: crypt_word.c
# Include
# Include
# Include
Void main (INT argc, char ** argv)
{
If (argc! = 3) Exit (0 );
Printf ("% s/n", crypt (argv [1], argv [2]);
}
Compile
Gcc-O crypt_word crypt. C-lcrypt
Inspection
Please first read your/etc/passwd, find your own account, and read the first two words, that is your own
Salt. Next, enter:
./Crypt_word your_password salt
Check if they are the same (they should be the same unless you add crypt plugin or use different crypt functions, such as shadow and Pam, in which case the encryption words are different ), check whether they contain 13 characters.
You can also use the htpasswd attached to Apache to generate encryption words for verification.
Example 2: verify_passwd.c
Note: This example reads data from/etc/passwd and does not apply to systems that use shadow or Pam (for example, slackware, RedHat, and Debian without crypt plugin, should be the same ). This example is only for reference. To understand the operation of the crypt function, you should avoid similar writing when writing a program.
# Include
# Include
# Include
Typedef struct {
Char username [64];
Char passwd [16];
Int uid;
Int GID;
Char name [256];
Char root [256];
Char shell [256];
} Account;
/* Note! The following statements do not apply to software development in the real world! */
Int acc_info (char * info, account * User)
{
Char * Start = Info;
Char * Now = Info;
/* Username */
While (* Now & * now! = ':') Now ++;/* This is a super Security Vulnerability */
If (! * Now) return 0;
* Now = 0; now ++;
Strcpy (User-> username, start);/* This causes buffer overflow */
Start = now;
/* Passwd */
While (* Now & * now! = ':') Now ++;/* This is a super Security Vulnerability */
If (! * Now) return 0;
* Now = 0; now ++;
Strcpy (User-> passwd, start);/* This causes buffer overflow */
Start = now;
/* Uid */
While (* Now & * now! = ':') Now ++;
If (! * Now) return 0;
* Now = 0; now ++;
User-> uid = atoi (start );
Start = now;
/* GID */
While (* Now & * now! = ':') Now ++;
If (! * Now) return 0;
* Now = 0; now ++;
User-> gid = atoi (start );
Start = now;
/* Name */
While (* Now & * now! = ':') Now ++;/* This is a super Security Vulnerability */
If (! * Now) return 0;
* Now = 0; now ++;
Strcpy (User-> name, start);/* this will cause buffer overflow */
Start = now;
/* Root */
While (* Now & * now! = ':') Now ++;/* This is a super Security Vulnerability */
If (! * Now) return 0;
* Now = 0; now ++;
Strcpy (User-> root, start);/* this will cause buffer overflow */
Start = now;
/* Shell */
While (* Now & * now! = ':') Now ++;/* This is a super Security Vulnerability */
* Now = 0; now ++;
Strcpy (User-> shell, start);/* this will cause buffer overflow */
Start = now;
Return 1;
}
Int read_password (char * filename, account * Users)
{
File * FP;
Char Buf [1024];
Int N;
N = 0;
Fp = fopen (filename, "RT ");
While (fgets (BUF, 1024, FP )! = NULL ){
If (acc_info (BUF, & users [N]) n ++;
}
Fclose (FP );
Return N;
}
Void main (INT argc, char ** argv)
{
Int N, I, done;
Account ACC [128];
Char username [256];
Char password [256];
Char * passwd;
Char Salt [4];
If (argc <2 ){
Printf ("username :");
Scanf ("% s", username);/* This is a super Security Vulnerability */
} Else strcpy (username, argv [1]);/* This is a super Security Vulnerability */
If (argc <3 ){
Printf ("Password :");
Scanf ("% s", password);/* This is a super Security Vulnerability */
} Else strcpy (password, argv [2]);/* This is a super Security Vulnerability */
N = read_password ("/etc/passwd", ACC );
For (I = 0, done = 0; I if (strcmp (username, ACC. Username) = 0 ){
Salt [0] = ACC. Passwd [0];
Salt [1] = ACC. Passwd [1];
Salt [2] = 0;
Passwd = crypt (password, salt );
Printf ("% S % s/n", ACC. Username, ACC. Passwd, passwd );
If (strcmp (passwd, ACC. Passwd) = 0 ){
Printf ("Login successfully! /N ");
} Else {
Printf ("Incorrect password! /N ");
}
Done = 1;
}
If (! Done) printf ("invalid username! /N ");
}
Compile
Gcc-O verify_passwd verify_passwd.c-lcrypt
Inspection
./Verify_passwd your_username your_password
Avoid Security Vulnerabilities
Buffer overflow is a serious security vulnerability. Generally, you cannot use announcements like char Buf [xxxx. In this type of security-related program writing (not only passwords, such as WWW, FTP, or telnet ), check the string length first. For example:
Len = strlen (incoming_username );
If (LEN> XXX) invalid;
New_string = (char *) malloc (LEN + 1 );
Strcpy (new_string, incoming_username );
Your_own_operations...
In this way, we can avoid buffer overflow and avoid making assumptions. Remember to make this mistake even by many experienced veterans who have decades of experience.
There are three stakeholders with the crypt function:
Void setkey (const char * Key );
Void encrypt (char * block, int edflag );
Void swab (const char * From, char * To, ssize_t N );
Generally, unless you have special requirements, you will not use these three.

 

Reference: http://www.chinalinuxpub.com/read.php? WID = 103