Passing passwords

[benthehutt]

Okay, so here's my "pipe theory."  Firstly, pipes send info immediately, so just piping in the password straight to smbclient doesn't work.  So here's how my theory works, a roundabout way:

Code Select Expand

benthehutt@mayonnaise ~ $ smclient \/\/ss1\/Win_Apps -U bmj465 | someCommand password &

OR

benthehutt@mayonnaise ~ $ smclient \/\/ss1\/Win_Apps -U bmj465 | sudo someCommand password &

#Where sudo is later used in order to delete this entry from bash.history and other such places

Note that the someCommand I am referring to doesn't exist (at least not to my knowledge) so I'll probably just end up writing one.  Here are the basic things it needs, I think (feel free to jump in anytime with hints or ideas, you know this alot better than me):

1.  someCommand uses either wait or sleep to check on smbclient.  Sleep would be used with a loop in order to check on the process every few seconds, wait would be used if the PID returns something when the password prompt comes up.  (I say both ways cause I don't know if wait will notice when the smbclient password prompt comes up, or if there is anyway to tell when it comes up with sleep)

2.  someCommand then passes the password to smbclient.  (It would be stored in $1, right?)

3.  someCommand would then delete necessary entries from bash.history, etc.

4.  someCommand exits and the smb server is connected

That's my theory anyway.  I haven't really looked into security issues, I think I'll look into the way passwd keeps stuff safe and try to emulate it.  Though, I don't really care about the security, so I'll probably put it off so long it never gets done (just being honest).  Please tell me any flaws or jumps in logic you see, you know alot more than me about this.

Thx

[Metgod]

Kind of a bit busier today, but here goes a hopefully useful/coherent reply:

Firstly, if you use a bash script for this command, then yes, the first argument after the command name would be in '$1'.

If I were to write a program for this, I'd probably try to use C (because then you have certain system calls at your disposal, among other things).

For how passwd does things, check in to the crypt (3) function ('man 3 crypt'). Also might want to check login(1) and passwd(1). Basically, the system takes what you supply as the password, encrypts it with the same algorithm and salt (etc) and then compares it to the entry in the real encrypted password file (the shadow file in these days). But all of that might not even be important for what you're after.


Now for your task:

I can't think of a way off the top of my head (that I know will work 100%). But here are some ideas to play with.

- Extend samba to allow you to pass the password (I don't have any idea how samba is coded but I'd imagine this is possible somehow). I don't see why this wouldn't work...

- I had played with an idea of using the pipe (or popen since I'm lazy ) system calls, but unfortunately that won't work nicely I think. But see below about IPC in general.

In addition:

I'm not sure the command you had thought out would work in the way you suggested. The reason is the way pipes work. That being said, if this is possible (without sudo), you will need to have the two programs communicate with each other (via IPC etc [pipes being one of the forms of ipc]).

Admittedly, IPC isn't my strong point, but it's something I've studied briefly and am hoping to study it more very soon (actually quite a few things).

Samba is open source, right ? I think of the things I mentioned, the most efficient way would be to extend samba.  Basically something like this (haven't thought this out in full though):

You pass the client a password via an option, and set a flag saying the password is already specified. Then, when the program would normally prompt the user.. if the certain flag is set, then you just use that string (the password) instead. AFter it's done, clear the password (which you allocated when the password is passed in).

I'm kind of distracted, so better post this so you at least have some more ideas. I should be able to reply some time later today. So if you have anything else thought out, I can reply then.

Hopefully I can have more time then too and help more.

[Metgod]

Decided to do a bit of research .... So, you might want to take a look at these:

http://us4.samba.org/samba/docs/man/Samba-HOWTO-Collection/passdb.html#id2570000


Particularly this part:

set to NULL user passwords

I think that might be of help (that or I read it wrong).

Also:
http://us4.samba.org/samba/docs/man/Samba-HOWTO-Collection/passdb.html#id2571979

And even better:

Or both the username and password can be supplied by using the -U option, including the username and password separated by a percent (%) character:

$ smbclient //maya/e -U kelly%kellyspassword

More of which can be found here:

http://us4.samba.org/samba/docs/using_samba/ch05.html

Does this help ? :)

[benthehutt]

HA!  Metty you're a genius!!  Or at least a man that researches things he does thoroughly!  Anyway, thanks for this stuff, that's a ton easier then my crappy way...  I wonder how I never came across that stuff?  Anyhew, I still learned alot about stuff, especially sudo, smbclient, passwd, and stdin.  Thanks for all the help!  (*Runs of dancing and jumping and throwing brightly colored bits of paper into the air*)

[benthehutt]

Thanks to you I've just finished a completed script, what was that, all of two minutes?

[Metgod]

Yeah... *rofl*

It's okay though. Easy to do. I could see myself doing just what you did.

Glad you learned some things though. And that must be why you didn't look for it... since everything has a reason to it.. in some way or another.

Glad to be of help.

[wilnix]

This may have been noticed (or not) because I didnt read the whole thread, but I noticed something about using pipes in your code. I would be against it if it were taking any user data without being run through taint or some other checks first. Pipes leave the ability for users to repipe elsewhere and/or ; && out to another execution.

Just FYI in case that was your plan.

Thanks,

Wilnix

[wilnix]

I didnt want to leave myself with a statement like above without an example. I wrote this in perl, but it really doesnt matter what language you choose (except that dreaded java crap)....

Code Select Expand

#!/usr/bin/perl -w
# pipe.pl
#pipe checkin proggy by wilnix

while (<STDIN>) {
  system "echo hello | echo $_"; 
}
                                                                                

Run this locally and type in the following:

ass | cat /etc/passwd

and check out the results. Fun stuff...

Wilnix

[Metgod]

Nope, wasn't what I was thinking of....

[wilnix]

okay, I'll shut up then  

Wilnix

[Metgod]

No need -- it was a good (okay, excellent) point!

[benthehutt]

What is taint?

By the way, is there a limit on pipes?  Can you pipe more than once in a single line?  I'm not sure if I'd ever have need to, just wondering...

[Metgod]

http://gunther.web66.com/FAQS/taintmode.html#what

for instance.

And yes, you can use pipes more than once on the same line ...

You can redirect any combination of the outputs/inputs (stdout, stdin, stderr) as well.

Want to hear something else ? You can even use the 'tee' command to write the same output to files and stdout at the same time (which is quite useful at times). See 'man tee' (or 'info tee' if you're a info junkie).

The unix / linux shells are really quite powerful.

[benthehutt]

Word.