Getting started with Linux programming-crypt

For more information about Linux programming and kernel, see crypt. Crypt is a cryptographic function based on the Data Encryption Standard (DES) algorithm.

Crypt is basically One way encryption. Therefore, crypt is only applicable to passwords and not data encryption.

Char * crypt (const char * key, const char * salt );

The key is the user's password. Salt is two words, each word can be selected from [a-zA-Z0-9./], so the same password increases by 4096 possibilities. Obtain the 56-bit keyword by using the lower seven-bit yuan of each word in the key. These 56-bit keywords are used to encrypt a group of words, this group contains 13 printable ASCII characters, including the first two salts.

Crypt is used when you have self-managed users, such as member websites and BBS.

Example 1: crypt_word.c

# Include
# Include
# Include

Void main (int argc, char ** argv)
{
If (argc! = 3) exit (0 );
Printf ("% s \ n", crypt (argv [1], argv [2]);
}

Compile

Gcc-o crypt_word crypt. c-lcrypt

Inspection

First look at your/etc/passwd, find your own account, look at the first two words, that is your own salt. Next, enter:

./Crypt_word your_password salt

Check if they are the same (they should be the same unless you add crypt plugin or use different crypt functions, such as shadow and pam, in which case the encryption words are different ), check whether they contain 13 characters.

You can also use the htpasswd attached to Apache to generate encryption words for verification.


Example 2: verify_passwd.c

Note: This example reads data from/etc/passwd and does not apply to systems that use shadow or pam (such as slackware, RedHat, and Debian without crypt plugin, should be the same ). This example is for reference only. To understand the operation of the crypt function, you should avoid similar writing when writing a program.

# Include
# Include
# Include

Typedef struct {
Char username [64];
Char passwd [16];
Int uid;
Int gid;
Char name [256];
Char root [256];
Char shell [256];
} Account;

/* Note! The following statements do not apply to software development in the real world! */

Int acc_info (char * info, account * user)
{
Char * start = info;
Char * now = info;

/* Username */
While (* now & * now! = \ ': \') Now ++;/* This is a super Security Vulnerability */
If (! * Now) return 0;
* Now = 0; now ++;
Strcpy (user-> username, start);/* This causes buffer overflow */
Start = now;

/* Passwd */
While (* now & * now! = \ ': \') Now ++;/* This is a super Security Vulnerability */
If (! * Now) return 0;
* Now = 0; now ++;
Strcpy (user-> passwd, start);/* This causes buffer overflow */
Start = now;

/* Uid */
While (* now & * now! = \ ': \') Now ++;
If (! * Now) return 0;
* Now = 0; now ++;
User-> uid = atoi (start );
Start = now;


/* Gid */
While (* now & * now! = \ ': \') Now ++;
If (! * Now) return 0;
* Now = 0; now ++;
User-> gid = atoi (start );
Start = now;

/* Name */
While (* now & * now! = \ ': \') Now ++;/* This is a super Security Vulnerability */
If (! * Now) return 0;
* Now = 0; now ++;
Strcpy (user-> name, start);/* this will cause buffer overflow */
Start = now;

/* Root */
While (* now & * now! = \ ': \') Now ++;/* This is a super Security Vulnerability */
If (! * Now) return 0;
* Now = 0; now ++;
Strcpy (user-> root, start);/* this will cause buffer overflow */
Start = now;

/* Shell */
While (* now & * now! = \ ': \') Now ++;/* This is a super Security Vulnerability */
* Now = 0; now ++;
Strcpy (user-> shell, start);/* this will cause buffer overflow */
Start = now;
Return 1;
}

Int read_password (char * filename, account * users)
{
FILE * fp;
Char buf [1024];
Int n;

N = 0;
Fp = fopen (filename, "rt ");
While (fgets (buf, 1024, fp )! = NULL ){
If (acc_info (buf, & users [n]) n ++;
}
Fclose (fp );
Return n;
}

Void main (int argc, char ** argv)
{
Int n, I, done;
Account ACC [128];
Char username [256];
Char password [256];
Char * passwd;
Char salt [4];

If (argc <2 ){
Printf ("username :");
Scanf ("% s", username);/* This is a super Security Vulnerability */
} Else strcpy (username, argv [1]);/* This is a super Security Vulnerability */
If (argc <3 ){
Printf ("password :");
Scanf ("% s", password);/* This is a super Security Vulnerability */
} Else strcpy (password, argv [2]);/* This is a super Security Vulnerability */

N = read_password ("/etc/passwd", ACC );

For (I = 0, done = 0; I if (strcmp (username, ACC . Username) = 0 ){
Salt [0] = ACC. Passwd [0];
Salt [1] = ACC. Passwd [1];
Salt [2] = 0;
Passwd = crypt (password, salt );
Printf ("% s \ n", ACC. Username, ACC. Passwd, passwd );
If (strcmp (passwd, ACC. Passwd) = 0 ){
Printf ("login successfully! \ N ");
} Else {
Printf ("incorrect password! \ N ");
}
Done = 1;
}
If (! Done) printf ("invalid username! \ N ");
}

Compile

Gcc-o verify_passwd verify_passwd.c-lcrypt

Inspection

./Verify_passwd your_username your_password


Avoid Security Vulnerabilities

Buffer overflow is a serious security vulnerability. Generally, you cannot use announcements like char buf [xxxx. In any program writing related to security (not only passwords, such as www, ftp, or telnet ), check the string length first. For example:

Len = strlen (incoming_username );
If (len> xxx) invalid;
New_string = (char *) malloc (len + 1 );
Strcpy (new_string, incoming_username );
Your_own_operations...

In this way, we can avoid buffer overflow and avoid making assumptions. Remember to make this mistake even by many experienced veterans who have decades of experience.

There are three stakeholders with the crypt function:

Void setkey (const char * key );
Void encrypt (char * block, int edflag );
Void swab (const char * from, char * to, ssize_t n );

Generally, unless you have special requirements, you will not use these three.