Re: Change linux password using php

Yeah, it is my understanding that Mandrake is based on Redhat. The algorithm used, according to john the ripper, is FreeBSD MD5 (i guess they have their own version of it...) There are different salts for each username (which i am guessing would be the username since if you change the username in the shadow file and leave the password you can't login- *DON'T USE THE ROOT ACCOUNT TO TEST THIS!!!*). I'll keep working on it as long as i find it interesting. On Friday 05 October 2001 05:02 pm, you wrote: > Thanks for the replies, > Don't worry about the Mandrake specific stuff; I'm on Redhat. although it > seems to the same as what you're talking about; > > My shadow is in format: > fakeaccount:$1$5PXJfLSQ$LSxsnZfHzBrkDdT2NZefK.:11600:0:99999:7::: > > (the password was 'password') > > I probably would not have the .php script make the changes; it would need > to run as root and I can't have that. I would make a simple C program which > would go 'changepwd <username> <newpasswordencrypted>' as i said before. > this means i can have that run as root, and -know- all it will do is change > passwords. Yeah I would probably put the requirement to put in old password > as well, although to get to that screen you need to get there anyway ... > > Evan Nemerson wrote: > > Here's what I got from the mandrake security mailing list so far: > > > > > > > > > > This is strange. I was just going to write a mail to this list about > > this. it seems that /etc/shadow accepts both crypt passwords (the short > > passwd) and MD5 passwords. (34 characters with $ and slashes does seem > > to me like md5). I found this because I was transferring users between > > servers so I copy and pasted the passwords and it worked on both > > occasions. very strange... > > > > Bye > > -- > > Haim > > > > On Thu, Oct 04, 2001 at 11:07:57PM -0700, Evan Nemerson wrote: > >> Does anyone know what algorithm is used on the passwords in the > >> /etc/shadow or /etc/passwd files? All the documentation I can find says > >> crypt is used with two characters of salt which should output 13 > >> characters. However my shadow file shows 34 character strings with > >> dollar signs and slashes (shouldn't the output be alpha-numeric???). I > >> already checked md5- nope. > >> > >> Please reply to my e-mail address since i don't subscribe to this list > >> (sorry, but i get enough php-general to keep me busy). > >> > >> > >> Thanks in advance, > >> Evan Nemerson