Re: AW: AW: AW: [vchkpw] Clear Passwords

[Evren Yurtesen]

Hmm what happens if you give 098f6bcd4621d373cade4e832627b4f6 as salt? and
test with the password from vpopmail (the users decrypted password) ?

Evren

On Mon, 25 Aug 2003, Andrej Dragicevic wrote:

 Here is a sample.
 
 $pwd = \$1\$LObTh\$LcOWUS4U6glAr2vB4oycr0; // this is the vpopmail
 password
 $decrypted = test;
 
 ?php
 if ( crypt($decrypted, \$1\$LObTh\$) ==  $pwd) 
   echo success!;
 else
   echo failure!;
 ?
 
 Thanks to the list, Evren and Rudi to help me understand something about
 cryptography.
 
 Andrej.
 
 
 -Ursprüngliche Nachricht-
 Von: Evren Yurtesen [mailto:[EMAIL PROTECTED] 
 Gesendet: Montag, 25. August 2003 14:15
 An: Andrej Dragicevic
 Cc: [EMAIL PROTECTED]
 Betreff: Re: AW: AW: [vchkpw] Clear Passwords
 
 It depends on your crypt library. If you are using blowfish or
 something?
 Mine returns md5 and it can work with both DES and MD5 at the same time
 (on freebsd)
 
 I am sorry that this is not so good help to you, but you can still try
 the
 password that vpopmail returns in your web thingy. There is a
 possibility
 that your crypt libraries might process this password especially if this
 is on the same machine. The program should use the same settings.
 
 One thing is that you can not get your cleartext passwords anymore
 unless
 you change all the email passwords or you clear all the user passwords
 and
 use the password learning option, although this is little bit risky.
 
 Evren
 
 On Mon, 25 Aug 2003, Andrej Dragicevic wrote:
 
  Yes, but I need to know how is vpopmail crypting passwords. It isn't
  md5. Do you know how are passwords crypted?
  
  For example:
  If I have a password test, the md5 string is
  098f6bcd4621d373cade4e832627b4f6. Vpopmail returns a string
  $1$LObTh$LcOWUS4U6glAr2vB4oycr0 for the same password.
  
  -Ursprüngliche Nachricht-
  Von: Evren Yurtesen [mailto:[EMAIL PROTECTED] 
  Gesendet: Montag, 25. August 2003 13:45
  An: Andrej Dragicevic
  Betreff: Re: AW: [vchkpw] Clear Passwords
  
  isnt that web module support crypted passwords?
  
  On Mon, 25 Aug 2003, Andrej Dragicevic wrote:
  
   I want to synchronize vpopmail passwords with another web module...
 So
  I
   need to get all passwords from vpopmail, put them into database, so
  that
   the web module can use these passwords for authorization...
   
   
   
   -Ursprüngliche Nachricht-
   Von: Evren Yurtesen [mailto:[EMAIL PROTECTED] 
   Gesendet: Montag, 25. August 2003 12:44
   An: Andrej Dragicevic
   Cc: [EMAIL PROTECTED]
   Betreff: Re: [vchkpw] Clear Passwords
   
   unless you compiled in clear password support in vpopmail when you
  were
   installing it, you can not get.
   if you didnt compile in at first and now all your passwords are
   encrypted.
   There is no way of getting the clearpassword for you.
   why do you need it anyway?
   
   On Mon, 25 Aug 2003, Andrej Dragicevic wrote:
   
Hello List,

I want to get all passwords from vpopmail (ver. 5.2) accounts. If
 I
   use
vuserinfo with -p option, the function returns a crypted password.
  How
do I get clear password from the returned string, for example with
PHP???

TIA. 



   
   
   
  
  
  
 
 
 
 
 
 
 
 
 

Re: AW: AW: AW: [vchkpw] Clear Passwords

[Paul L. Allen]

Andrej Dragicevic writes:

 Here is a sample.
 
 $pwd = \$1\$LObTh\$LcOWUS4U6glAr2vB4oycr0; // this is the vpopmail
 password
 $decrypted = test;
 
 ?php
 if ( crypt($decrypted, \$1\$LObTh\$) ==  $pwd) 
   echo success!;
 else
   echo failure!;
 ?

That approach works but relies upon you figuring out where the salt
ends and passing it to crypt.  The more popular flavours of Unix these 
days have at least two different ways of crypting the passwords: the
old-style DES-based and the new-style variant-MD5-based.  They have
different lengths of salt for the different methods.

An easier way to do it is to use the crypted password itself as
the salt, because a crypt that can handle both styles is usually
smart enough to accept the crypted password as salt and separate the
salt out itself.  So you'll probably find that

if (crypt($decrypted, $pwd) == $pwd)

does what you want.  Well, I'm assuming that in PHP == is a string
comparison operator as well as a numeric comparison operator (in perl
the string comparison operator is eq and your == comparison would
almost always be true even with the wrong password because strings which 
don't look like numbers are treated as 0 in perl).

-- 
Paul Allen
Softflare Support