src/org/ibex/crypto/EtcPasswd.java

   1 package org.ibex.crypto;
   2 import org.ibex.util.*;
   3 import java.util.*;
   4 import java.io.*;
   5
   6 /**
   7  *  Right now this is a big fat hack; at some point it would be nice
   8  *  to try lots of different techniques (JNI/getpwent(),
   9  *  Runtime.exec(),
  10  *  http://www.freebsd.org/cgi/cvsweb.cgi/src/lib/libcrypt/crypt-md5.c
  11  *
  12  *  Also, this currently assumes that the user has MD5 passwords
  13  *  enabled and OpenSSL installed.
  14  */
  15 public class EtcPasswd {
  16     public static boolean verify(String user, String pass) {
  17         try {
  18             BufferedReader br = new BufferedReader(new InputStreamReader(new FileInputStream("/etc/passwd-")));
  19             for(String s = br.readLine(); s != null; s = br.readLine()) {
  20                 StringTokenizer st = new StringTokenizer(s, ":");
  21                 if (!user.equals(st.nextToken())) continue;
  22                 try {
  23                     String stuff = st.nextToken();
  24                     StringTokenizer st2 = new StringTokenizer(stuff, "$");
  25                     st2.nextToken();
  26                     String salt = st2.nextToken();
  27                     Process p =
  28                         Runtime.getRuntime().exec(new String[] {
  29                             "/usr/bin/openssl",
  30                             "passwd",
  31                             "-1",
  32                             "-stdin",
  33                             "-salt",
  34                             salt });
  35                     PrintWriter pw = new PrintWriter(p.getOutputStream());
  36                     pw.println(pass);
  37                     pw.flush();
  38                     pw.close();
  39                     BufferedReader br2 = new BufferedReader(new InputStreamReader(p.getInputStream()));
  40                     String recrypt = br2.readLine();
  41                     p.waitFor();
  42                     if (recrypt.equals(stuff)) return true;
  43                 } catch (Exception e) { Log.warn(EtcPasswd.class, e); }
  44             }
  45         } catch (Exception e) { Log.warn(EtcPasswd.class, e); }
  46         return false;
  47     }
  48 }