From 82aced57b6606aa6560f069617443eba323e6aa4 Mon Sep 17 00:00:00 2001 From: hanez Date: Wed, 1 Jan 2025 06:23:03 +0100 Subject: [PATCH] Removed interactive mode (is default now), moved some code to checkpw.h and many fixes. --- LICENSE | 2 +- Makefile | 2 + README.md | 68 +++++++++++-------- checkpw.c | 191 ++++++++++++------------------------------------------ checkpw.h | 121 ++++++++++++++++++++++++++++++++++ 5 files changed, 206 insertions(+), 178 deletions(-) create mode 100644 checkpw.h diff --git a/LICENSE b/LICENSE index 0c72923..247aa29 100644 --- a/LICENSE +++ b/LICENSE @@ -1,4 +1,4 @@ -Copyright 2024 Johannes Findeisen +Copyright 2024 Johannes Findeisen Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/Makefile b/Makefile index 229ff1c..6b1f110 100644 --- a/Makefile +++ b/Makefile @@ -6,7 +6,9 @@ clean: install: cp ./checkpw /usr/bin/ + cp ./checkpw.h /usr/include/ uninstall: rm -f /usr/bin/checkpw + rm -f /usr/include/checkpw.h diff --git a/README.md b/README.md index 9a6e7d1..2f53c6a 100644 --- a/README.md +++ b/README.md @@ -4,84 +4,96 @@ checkpw is a program that checks the validity of a users password on a UNIX/PAM- Currently only tested on Linux, but it should work on the [AIX](https://en.wikipedia.org/wiki/IBM_AIX), [DragonFly BSD](https://www.dragonflybsd.org/), [FreeBSD](https://www.freebsd.org/), [HP-UX](https://en.wikipedia.org/wiki/HP-UX), [Linux](https://kernel.org/), [macOS](https://en.wikipedia.org/wiki/MacOS), [NetBSD](https://netbsd.org/) and [Solaris](https://en.wikipedia.org/wiki/Oracle_Solaris) operating system too. -## The idea behind: +## The idea -I needed a program to verify passwords of users on Linux based systems using PAM. +I needed a program to verify passwords of users on Linux/UNIX systems using PAM that just return 0 on success and 1 on error. -Exactly a program like this... not more! - -## Installation: - -**WARNING:** Install this software with care. checkpw could easily be used for bruteforcing passwords from local users! +## Building checkpw ``` git clone https://git.xw3.org/xw3/checkpw.git cd checkpw make -sudo make install ``` -The code only supports verifying passwords for user id 1000 by default. Look a the code for some compile time options! +The code only supports verifying passwords for user id 1000 by default. Look at the file checkpw.h for some compile time options! -### Manual installation: +### Custom build example -Set MAX_UID and MIN_UID in the code or you can compile checkpw without editing the code using the following command and install it manually: +Set MAX_UID and MIN_UID at compile time: ``` gcc -Wall -DMAX_UID=1000 -DMIN_UID=1000 -o checkpw checkpw.c -lpam -lpam_misc -sudo cp ./checkpw /usr/bin/ ``` -## Uninstall: +## Installation + +**WARNING:** Install this software with care. checkpw could easily be used for bruteforcing passwords from local users! + +``` +sudo make install +``` + +checkpw is installed to /usr/bin/. + +checkpw.h is installed to /usr/include/ for use in other applications. + +## Uninstall ``` sudo make uninstall ``` -## Usage: +## Usage ``` checkpw -h -Usage: checkpw [-u ] [-p ] [-i] [-v] [-h] +Usage: checkpw [-u ] [-p ] [-v] [-V] [-h] Options: -u Specify username. -p Specify password. - -i Enable interactive mode to prompt for missing username/password. -v Enable verbose mode. - -V Show program version. + -V Print program version. -h Show this help. ``` -Returns 0 on success, 1 otherwise. - -### Examples: - -#### Interactive mode: +You can also use checkpw even without installing by just running the following command: ``` -checkpw -i +./checkpk ``` -#### Interactive mode only asking for a password: +checkpw returns 0 on success, 1 otherwise. + +### Examples + + +#### Interactive mode asking for a username and a password ``` -checkpw -u hanez -i +checkpw ``` -#### None interactive mode with username and password provided as arguments to checkpw: +#### Interactive mode only asking for a password + +``` +checkpw -u hanez +``` + +#### None interactive mode with username and password provided as arguments to checkpw ``` checkpw -u hanez -p password ``` -#### Request the result from the above commands: +#### Request the result from the above commands ``` echo $? ``` -## Links: +## Links - [https://cr.yp.to/checkpwd.html](https://cr.yp.to/checkpwd.html) - [https://pamtester.sourceforge.net/](https://pamtester.sourceforge.net/) diff --git a/checkpw.c b/checkpw.c index 4acbd99..847b287 100644 --- a/checkpw.c +++ b/checkpw.c @@ -1,119 +1,23 @@ /** * checkpw is a program that checks the validity of a users password on a - * Linux/PAM-based system. + * UNIX/PAM-based system. * * Author: Johannes Findeisen - 2024 - * License: MIT (see LICENSE) + * License: Apache-2.0 (see LICENSE) */ -#include // For struct passwd and getpwnam -#include -#include #include #include #include #include -#include // For terminal input settings -#include // For getopt and access to user info +#include +#include -#define MAX_USERNAME_LEN 32 -#define MAX_PASSWORD_LEN 256 - -#ifndef MAX_UID -#define MAX_UID 1000 -#endif - -#ifndef MIN_UID -#define MIN_UID 1000 -#endif - -#define VERSION 1_0_3 - -// Custom data structure to hold user-entered password -struct pam_credentials -{ - const char *password; -}; - -// PAM conversation function to supply the password -int pam_conversation(int num_msg, const struct pam_message **msg, - struct pam_response **resp, void *appdata_ptr) -{ - struct pam_response *response = NULL; - struct pam_credentials *credentials = (struct pam_credentials *)appdata_ptr; - int i; - - response = (struct pam_response *)malloc(sizeof(struct pam_response) * num_msg); - if (response == NULL) - return PAM_CONV_ERR; - - for (i = 0; i < num_msg; i++) { - switch (msg[i]->msg_style) { - case PAM_PROMPT_ECHO_ON: - case PAM_PROMPT_ECHO_OFF: - response[i].resp = strdup(credentials->password); - response[i].resp_retcode = 0; - break; - default: - free(response); - return PAM_CONV_ERR; - } - } - - *resp = response; - return PAM_SUCCESS; -} - -int authenticate(const char *username, const char *password, int verbose) -{ - int retval; - pam_handle_t *pamh = NULL; - struct pam_credentials credentials = { password }; - struct pam_conv conv = { pam_conversation, &credentials }; - - if (verbose) - printf("Starting PAM authentication for user '%s'.\n", username); - - retval = pam_start("login", username, &conv, &pamh); - - if (retval == PAM_SUCCESS) { - if (verbose) - printf("PAM authentication initialized.\n"); - retval = pam_authenticate(pamh, 0); // Attempt to authenticate - } else { - if (verbose) - printf("pam_start failed: %s\n", pam_strerror(pamh, retval)); - } - - if (retval == PAM_SUCCESS) { - if (verbose) - printf("User '%s' authenticated successfully.\n", username); - - retval = pam_acct_mgmt(pamh, 0); // Check account validity - if (retval != PAM_SUCCESS && verbose) - printf("pam_acct_mgmt failed: %s\n", pam_strerror(pamh, retval)); - - } else { - if (verbose) - printf("pam_authenticate failed: %s\n", pam_strerror(pamh, retval)); - } - - if (pam_end(pamh, retval) != PAM_SUCCESS) { - pamh = NULL; - fprintf(stderr, "Failed to release PAM authenticator\n"); - exit(1); - } - - if (retval != PAM_SUCCESS && verbose) { - printf("Authentication failed for user '%s'.\n", username); - } - - return (retval == PAM_SUCCESS ? 0 : 1); // 0 for success, 1 for failure -} +#include "checkpw.h" // Function to prompt user for input, optionally hiding input void prompt_for_input(char *buffer, size_t size, const char *prompt, - int hide_input) + bool hide_input) { printf("%s", prompt); fflush(stdout); @@ -159,41 +63,42 @@ void prompt_for_input(char *buffer, size_t size, const char *prompt, void print_usage(const char *prog_name) { - fprintf(stderr, "\n"); - fprintf(stderr, "Usage: %s [-u ] [-p ] [-i] [-v] [-h]\n", prog_name); - fprintf(stderr, "\n"); - fprintf(stderr, "Options:\n"); - fprintf(stderr, " -u Specify username.\n"); - fprintf(stderr, " -p Specify password.\n"); - fprintf(stderr, " -i Enable interactive mode to prompt for missing username/password.\n"); - fprintf(stderr, " -v Enable verbose mode.\n"); - fprintf(stderr, " -V Show program version.\n"); - fprintf(stderr, " -h Show this help.\n"); - fprintf(stderr, "\n"); + printf("\n"); + printf("Usage: %s [-u ] [-p ] [-v] [-V] [-h]\n", + prog_name); + printf("\n"); + printf("Options:\n"); + printf(" -u Set username (if not set, the program asks for it).\n"); + printf(" -p Set password (if not set, the program asks for it).\n"); + printf(" -v Enable verbose mode.\n"); + printf(" -V Print program version.\n"); + printf(" -h Show this help.\n"); + printf("\n"); } int main(int argc, char *argv[]) { - bool interactive = false; bool verbose = false; bool version = false; - char username[MAX_USERNAME_LEN] = {0}; char password[MAX_PASSWORD_LEN] = {0}; + char username[MAX_USERNAME_LEN] = {0}; int opt; // Parse command-line arguments - while ((opt = getopt(argc, argv, "u:p:hivV")) != -1) { + while ((opt = getopt(argc, argv, "u:p:hvV")) != -1) { switch (opt) { case 'u': if (strlen(optarg) >= MAX_USERNAME_LEN) { - fprintf(stderr, "Error: Username is too long (maximum %d characters).\n", MAX_USERNAME_LEN); + fprintf(stderr, "Error: Username is too long (maximum %d characters).\n", + MAX_USERNAME_LEN); exit(1); } strncpy(username, optarg, MAX_USERNAME_LEN - 1); break; case 'p': if (strlen(optarg) >= MAX_PASSWORD_LEN) { - fprintf(stderr, "Error: Password is too long (maximum %d characters).\n", MAX_PASSWORD_LEN); + fprintf(stderr, "Error: Password is too long (maximum %d characters).\n", + MAX_PASSWORD_LEN); exit(1); } strncpy(password, optarg, MAX_PASSWORD_LEN - 1); @@ -201,9 +106,6 @@ int main(int argc, char *argv[]) case 'h': print_usage(argv[0]); exit(0); - case 'i': - interactive = true; - break; case 'v': verbose = true; break; @@ -211,38 +113,27 @@ int main(int argc, char *argv[]) version = true; break; default: - print_usage(argv[0]); - exit(1); + break; } } if (version) { - printf("1.0.3\n"); + printf("%s\n", VERSION); exit(0); } - // If interactive mode is enabled, prompt for missing username and/or password - if (interactive) { - if (username[0] == '\0') { - prompt_for_input(username, sizeof(username), "Username: ", 0); - if (strlen(username) == 0) { - fprintf(stderr, "Error: Username cannot be empty.\n"); - exit(1); - } + if (username[0] == '\0') { + prompt_for_input(username, sizeof(username), "Username: ", false); + if (strlen(username) == 0) { + fprintf(stderr, "Error: Username cannot be empty.\n"); + exit(1); } + } - if (password[0] == '\0') { - prompt_for_input(password, sizeof(password), "Password: ", 1); - if (strlen(password) == 0) { - fprintf(stderr, "Error: Password cannot be empty.\n"); - exit(1); - } - } - } else { - // If not in interactive mode, ensure username and password are provided - if (username[0] == '\0' || password[0] == '\0') { - fprintf(stderr, "Error: Username and password must be provided unless interactive mode is enabled.\n"); - print_usage(argv[0]); + if (password[0] == '\0') { + prompt_for_input(password, sizeof(password), "Password: ", true); + if (strlen(password) == 0) { + fprintf(stderr, "Error: Password cannot be empty.\n"); exit(1); } } @@ -254,17 +145,19 @@ int main(int argc, char *argv[]) exit(1); } - // Check if the user's UID is below the minimum allowed UID and not higher than maximum allowed UID + // Check if the user's UID is below the minimum allowed UID and not higher + // than maximum allowed UID if (pwd->pw_uid < MIN_UID || pwd->pw_uid > MAX_UID) { - fprintf(stderr, "Error: User '%s' has a UID less than %d or higher than %d and is not allowed to authenticate.\n", username, MIN_UID, MAX_UID); + fprintf(stderr, "Error: User '%s' has a UID higher than %d or lower than %d and is not allowed to authenticate.\n", + username, MAX_UID, MIN_UID); exit(1); } if (verbose) - printf("User '%s' passed UID check (UID: %d).\n", username, pwd->pw_uid); + printf("User '%s' passed UID check (UID: %d).\n", username, + pwd->pw_uid); - // Authenticate the user - if (authenticate(username, password, verbose) == 0) { + if (authenticate(username, password, verbose) == true) { printf("Authenticated successfully.\n"); return 0; } else { diff --git a/checkpw.h b/checkpw.h new file mode 100644 index 0000000..3620e40 --- /dev/null +++ b/checkpw.h @@ -0,0 +1,121 @@ +/** + * checkpw.h is part of checkpw, a program that checks the validity of a users + * password on a UNIX/PAM-based system. + * + * Author: Johannes Findeisen - 2025 + * License: Apache-2.0 (see LICENSE) + */ + +#include +#include +#include + +#define VERSION "1.1.0" + +#ifndef MAX_PASSWORD_LEN +#define MAX_PASSWORD_LEN 256 +#endif + +#ifndef MAX_USERNAME_LEN +#define MAX_USERNAME_LEN 32 +#endif + +#ifndef MAX_UID +#define MAX_UID 1000 +#endif + +#ifndef MIN_UID +#define MIN_UID 1000 +#endif + +bool authenticate(const char *username, const char *password, bool verbose); + +int pam_conversation(int num_msg, const struct pam_message **msg, + struct pam_response **resp, void *appdata_ptr); + +struct pam_credentials +{ + const char *password; +}; + +bool authenticate(const char *username, const char *password, bool verbose) +{ + int retval; + pam_handle_t *pamh = NULL; + struct pam_credentials credentials = { password }; + struct pam_conv conv = { pam_conversation, &credentials }; + + if (verbose) + printf("Starting PAM authentication for user '%s'.\n", username); + + retval = pam_start("login", username, &conv, &pamh); + + if (retval == PAM_SUCCESS) { + if (verbose) + printf("PAM authentication initialized.\n"); + retval = pam_authenticate(pamh, 0); // Attempt to authenticate + } else { + if (verbose) + fprintf(stderr, "Error: pam_start failed: %s\n", pam_strerror(pamh, + retval)); + } + + if (retval == PAM_SUCCESS) { + if (verbose) + printf("User '%s' authenticated successfully.\n", username); + + retval = pam_acct_mgmt(pamh, 0); // Check account validity + if (retval != PAM_SUCCESS && verbose) + fprintf(stderr, "Error: pam_acct_mgmt failed: %s\n", + pam_strerror(pamh, retval)); + } else { + if (verbose) + fprintf(stderr, "Error: pam_authenticate failed: %s\n", + pam_strerror(pamh, retval)); + } + + if (pam_end(pamh, retval) != PAM_SUCCESS) { + pamh = NULL; + fprintf(stderr, "Error: Failed to release PAM authenticator.\n"); + exit(1); + } + + if (retval != PAM_SUCCESS && verbose) { + fprintf(stderr, "Error: Authentication failed for user '%s'.\n", + username); + } + + return (retval == PAM_SUCCESS ? true : false); +} + +// PAM conversation function to supply the password +int pam_conversation(int num_msg, const struct pam_message **msg, + struct pam_response **resp, void *appdata_ptr) +{ + struct pam_response *response = NULL; + struct pam_credentials *credentials = (struct pam_credentials *)appdata_ptr; + int i; + + response = (struct pam_response *)malloc(sizeof(struct pam_response) + * num_msg); + + if (response == NULL) + return PAM_CONV_ERR; + + for (i = 0; i < num_msg; i++) { + switch (msg[i]->msg_style) { + case PAM_PROMPT_ECHO_ON: + case PAM_PROMPT_ECHO_OFF: + response[i].resp = strdup(credentials->password); + response[i].resp_retcode = 0; + break; + default: + free(response); + return PAM_CONV_ERR; + } + } + + *resp = response; + return PAM_SUCCESS; +} +