0

What program just asks specified user's password (even if calling user is root) and returns exit code 0 if it is OK and 1 if it fails?

Is there such a simple program (i.e. not "sudo" with edited config) to do the task?

Also I'm looking for program that will log in user (checking its password, writing to auth.log), but not execute any programs (like login), simply return the exit code.

Improve this question

3 Answers 3

Reset to default
1

You want a utility known as pwauth. It does exactly what you describe: accepts a username and password, and then returns an exit code based on validity. It's designed to be used with apache's mod_auth_external to hook into system authentication, but should work just fine for what you want.

Improve this answer
9
  • Good, but it 1. doesn't allow user to be specified on command line, 2. reads password from terminal insecurely.
    – Vi.
    Aug 16, 2012 at 22:29
  • @Vi. this is a low-level thing meant to be called from other programs, feeding the username and password to stdin over a pipe. Running it directly on a terminal is a valid way to test it, but not a normal mode of use. The program which calls pwauth is responsible for acquiring the password from the user in a sensible way, and taking care of all the other things that e.g. login would normally do.
    – Alan Curry
    Aug 16, 2012 at 23:18
  • 3. No log messages appears when checking it, 4. It fails to check root's password...
    – Vi.
    Aug 16, 2012 at 23:19
  • 1
    @Vi.what would be the reason for it? su user -c true is close. But I don't understand why you want to do it. Are you going to be providing a service to the user you're authenticating? Or is this for some kind of lazy blackhat dictionary attack?
    – Alan Curry
    Aug 16, 2012 at 23:39
  • 2
    If you think you can write a better su than su then you should be competent enough to perform authentication in your own C code. Your "punt to an external process" method is lazy. The bad kind of lazy. And the fact that you can't even figure out how to get a password from the user and feed it to pwauth is a sign you shouldn't be writing security-sensitive code yet.
    – Alan Curry
    Aug 17, 2012 at 8:23
1

What you are trying to defeats the purpose of an user session, the user has already typed that password when he logged in to his account so it is rude to ask it again for your task; if you do want your program to be based on logging in then the best approach is to support the key rings, this allows the user itself to choose whether or not to explicitly type a password for your task.

Don't force users to type correct horse battery staple again when they just did...

Improve this answer
8
  • The user is expected to type other user's password, like in su. It is part of non-standard login scheme.
    – Vi.
    Aug 17, 2012 at 0:29
  • 1
    @Vi That is a very bad login scheme. No user should know another user's password. Ever. For any reason. This is why su is generally phased out, and most distributions push their users towards sudo.
    – Darth Android
    Aug 17, 2012 at 14:21
  • I'm using my own user account (among other specialized per-application accounts), but also know root's password on my computer. I don't like sudo because of it seems to be overly complicated (special config file) and don't 100% understand how it works, it relies on suid bit (which I want to try turning off entirely making all filesystems mounted "nosuid"); I want simpler password to be used in regular account and complex password to be used for root. And I want to keep the whole system simple (i.e. not to care about everything everywhere like in suid-bit programs) yet secure.
    – Vi.
    Aug 17, 2012 at 16:35
  • @Vi disabling the setuid bit will break so many programs, including mount itself and passwd, unless you run them at root every single time. That flag is for mounting untrusted filesystems (flash drives, etc.) into the system, but is crucially depended upon for trusted filesystems/utilities. You will not increase security of a system with what you are doing, and if anything are adding additional layers of untested and potentially exploitable code into your authentication scheme.
    – Darth Android
    Aug 17, 2012 at 16:47
  • 1
    @Vi.: You have mentioned simple a few times; just follow your distro guide to set up sudo and be done with it. Given your attitude to keep things simple anything more complex will only yield a broken system, that's because you are trying to keep the complex things simple and hence don't get enough understanding about the consequences of certain solutions. If you can't get sudo to work you could go for su - and then detach (CTRL-D) when you are done, either one is simple and secure enough to fit your needs. If expirementation isn't a harm, why obsess over complex non-standard security?
    – Tamara Wijsman
    Aug 17, 2012 at 16:53
0

Looks like the simplest way is to write it using python-pam using /usr/share/doc/python-pam/examples/pamtest.py as example. The example reads password, authenticates user using PAM and writes message depending on the result. Can be easily changed to varied exit code.

Improve this answer
1
  • Please add a link to the python-pam project and to the example if possible, so people will have a better idea about what you're talking about.
    – Cristian Ciupitu
    Jun 21, 2014 at 11:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .