userdb/userdbpw.html.in

   1 <?xml version="1.0"?>
   2 <html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/><title>userdbpw</title><link rel="stylesheet" href="style.css" type="text/css"/><meta name="generator" content="DocBook XSL Stylesheets V1.72.0"/><link rel="start" href="#userdbpw" title="userdbpw"/><link xmlns="" rel="stylesheet" type="text/css" href="manpage.css"/><meta xmlns="" name="MSSmartTagsPreventParsing" content="TRUE"/><link xmlns="" rel="icon" href="icon.gif" type="image/gif"/><!--
   3
   4 Copyright 1998 - 2007 Double Precision, Inc.  See COPYING for distribution
   5 information.
   6
   7 --></head><body><div class="refentry" lang="en" xml:lang="en"><a id="userdbpw" shape="rect"> </a><div class="titlepage"/><div class="refnamediv"><h2>Name</h2><p>userdbpw — create an encrypted password</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="cmdsynopsis"><p><code class="command">userdbpw</code>  [[-md5] |  [-hmac-md5] |  [-hmac-sha1]]  | <br clear="none"/><code class="command">userdb</code>  {<em class="replaceable"><code>name</code></em>}  set  {<em class="replaceable"><code>field</code></em>}</p></div></div><div class="refsect1" lang="en" xml:lang="en"><a id="id282353" shape="rect"> </a><h2>DESCRIPTION</h2><p><span><strong class="command">userdbpw</strong></span> enables secure entry of encrypted
   8 passwords into <code class="filename">@userdb@</code>.</p><p><span><strong class="command">userdbpw</strong></span> reads a single line of text on
   9 standard input, encrypts it, and prints the encrypted result to standard
  10 output.</p><p>If standard input is attached to a terminal device,
  11 <span><strong class="command">userdbpw</strong></span> explicitly issues a "Password: " prompt on
  12 standard error, and turns off echo while the password is entered.</p><p>The <code class="option">-md5</code> option is available on systems that use
  13 MD5-hashed passwords (such as systems that use the current version of the
  14 PAM library for authenticating, with MD5 passwords enabled).
  15 This option creates an MD5 password hash, instead of using the
  16 traditional <code class="function">crypt()</code> function.</p><p><code class="option">-hmac-md5</code> and <code class="option">-hmac-sha1</code> options
  17 are available only if the userdb library is installed by an application
  18 that uses a challenge/response authentication mechanism.
  19 <code class="option">-hmac-md5</code> creates an intermediate HMAC context using the
  20 MD5 hash function. <code class="option">-hmac-sha1</code> uses the SHA1 hash function
  21 instead. Whether either HMAC function is actually available depends on the
  22 actual application that installs the <code class="option">userdb</code> library.</p><p>Note that even though the result of HMAC hashing looks like an encrypted
  23 password, it's really not.  HMAC-based challenge/response authentication
  24 mechanisms require the cleartext password to be available as cleartext.
  25 Computing an intermediate HMAC context does scramble the cleartext password,
  26 however if its compromised, it WILL be possible for an attacker to succesfully
  27 authenticate.  Therefore, applications that use challenge/response
  28 authentication will store intermediate HMAC contexts in the "pw" fields in the
  29 userdb database, which will be compiled into the
  30 <code class="filename">userdbshadow.dat</code>
  31 database, which has group and world permissions turned off. The
  32 userdb library also requires that the cleartext userdb source for the
  33 <code class="filename">userdb.dat</code> and
  34 <code class="filename">userdbshadow.dat</code> databases is also stored with the
  35 group and world permissions turned off.</p><p><span><strong class="command">userdbpw</strong></span> is usually used together in a pipe with
  36 <span><strong class="command">userdb</strong></span>, which reads from standard input. For example:</p><div class="blockquote"><blockquote class="blockquote"><div class="informalexample"><pre class="programlisting" xml:space="preserve"><span><strong class="command">userdbpw -md5 | userdb users/john set systempw</strong></span></pre></div></blockquote></div><p>or:</p><div class="blockquote"><blockquote class="blockquote"><div class="informalexample"><pre class="programlisting" xml:space="preserve"><span><strong class="command">userdbpw -hmac-md5 | userdb users/john set hmac-md5pw</strong></span></pre></div></blockquote></div><p>These commands set the <code class="option">systempw</code> field in the record for
  37 the user <code class="option">john</code> in <code class="filename">@userdb@/users</code> file, and the
  38 <code class="option">hmac-md5pw</code> field. Don't forget to run
  39 <span><strong class="command">makeuserdb</strong></span> for the change to take effect.</p><p>The following command does the same thing:</p><div class="blockquote"><blockquote class="blockquote"><div class="informalexample"><pre class="programlisting" xml:space="preserve"><span><strong class="command">userdb users/john set systempw=<code class="option">SECRETPASSWORD</code></strong></span></pre></div></blockquote></div><p>However, this command passes the secret password as an argument to the
  40 <span><strong class="command">userdb</strong></span> command, which can be viewed by anyone who happens
  41 to run
  42 <span class="citerefentry"><span class="refentrytitle">ps</span>(1)</span>
  43 at the same time. Using <span><strong class="command">userdbpw</strong></span> allows the secret password
  44 to be specified in a way that cannot be easily viewed by
  45 <span class="citerefentry"><span class="refentrytitle">ps</span>(1)</span>.</p></div><div class="refsect1" lang="en" xml:lang="en"><a id="id281936" shape="rect"> </a><h2>SEE ALSO</h2><p>
  46 <a href="userdb.html" target="_top" shape="rect"><span class="citerefentry"><span class="refentrytitle">userdb</span>(8)</span></a>,
  47
  48 <a href="makeuserdb.html" target="_top" shape="rect"><span class="citerefentry"><span class="refentrytitle">makeuserdb</span>(8)</span></a></p></div></div></body></html>