Return to BSD News archive
Path: euryale.cc.adfa.oz.au!newshost.anu.edu.au!harbinger.cc.monash.edu.au!news.uwa.edu.au!classic.iinet.com.au!swing.iinet.net.au!news.uoregon.edu!usenet.eel.ufl.edu!spool.mu.edu!howland.reston.ans.net!Germany.EU.net!Dortmund.Germany.EU.net!nntp.gmd.de!stern.fokus.gmd.de!zib-berlin.de!irz401!uriah.heep!not-for-mail
From: j@uriah.heep.sax.de (J Wunsch)
Newsgroups: comp.unix.bsd.freebsd.misc
Subject: Re: Bad crypt?
Date: 10 Oct 1995 22:53:23 +0100
Organization: Private FreeBSD site, Dresden.
Lines: 50
Message-ID: <45eq0j$5et@uriah.heep.sax.de>
References: <kchan-0110951556250001@adagio.kcc.hawaii.edu> <44rj41$c76@uriah.heep.sax.de> <kchan-0810951340130001@adagio.kcc.hawaii.edu>
NNTP-Posting-Host: uriah.heep.sax.de
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
Kenwrick Chan <kchan@leahi.kcc.hawaii.edu> wrote:
>... Got the following
>recommendations from someone from the MOO list.
>--
>Do the following from inside the MOO environment in question:
>
> ;crypt("some string")
> => "wOCq7A/q9eOLk"
> ;crypt("some string", "wO")
(I dunno why the semicolon is leading, but:)
;crypt("some string", "wOCq7A/q9eOLk")
i.e. using the entire encrypted string (where only the first couple
of characters will actually be used) does the same.
>You should get back the same result:
>
> => "wOCq7A/q9eOLk"
>
>If you don't get back the same result as the first crypt() call, your unix
>crypt implementation is broken, and that's your problem.
FreeBSD's crypt implementation is definately not broken; you could not
log in at all otherwise. :-)
FreeBSD's crypt implementation has two potential pitfalls:
The default encryption is MD5-based (and therefore even exportable
from the Land Without Restrictions). This causes it to use much
longer encrypted strings than have been used traditionally.
Applications that tend to rely on the encrypted string being only 12
characters long (which is not defined anywhere to be so) will fall
over.
FreeBSD uses an implicit shadow password algorithm to improve
security. You don't need something like -DSHADOW or similar as is
required by other systems, since the shadowing is transparent to the
getpw*() library functions. However you need (of course, that's why
there's shadowing at all) root privileges for any process that is
actually trying to read the real password. This can be done by making
this process setuid root, but a program needs to be designed for being
setuid, or it will potentially open security holes. (This however
applies to other shadowing systems as well.)
--
cheers, J"org
joerg_wunsch@uriah.heep.sax.de -- http://www.sax.de/~joerg/ -- NIC: JW11-RIPE
Never trust an operating system you don't have sources for. ;-)