Subject: Re: Passwords over 8 letters

From: [email-masked]
Date: Wed, 6 Nov 1996 01:16:09 EST

** Reply to note from [email-masked] Tue, 5 Nov 1996 08:39:08 -0600 (CST) 
>    
> All, 
>    
>   I am running the WUFTP 2.4.2 Beta 11 ftp server. I have compiled this to 
> work with our Digital 2100 running Digital Unix 3.2g (thanks to help from 
> these listservs!) I have only one problem left. The FTPD will not allow 
> authenticated users to log in if their password has more than 8 characters 
> in it. Has anyone been able to correct this problem? If so, let me know! I 
> will summarize everything. Thanks All!  
 
I've also had this same problem. I have however, managed to get mine to 
work. A lot of your ability to get longer passwords working with wu-ftpd 
(and just about any other package requiring identification) is to know 
the limitations of the crypt() function within libc.a (or other 
alternative). If you have a supplemental version of a crypt()-like 
function that you KNOW works with the encryption in your passwd file (or 
shadow file, whatever) then can make a simple change in ftpd.c. 
 
For example: Here's the function I changed in ftpd.c to get my long 
passwords working... 
 
void 
#ifdef __STDC__ 
pass(char *passwd) 
#else 
pass(passwd) 
char *passwd; 
#endif 
{ 
    char *xpasswd, 
     *salt; 
 
#ifdef ULTRIX_AUTH 
    int numfails; 
#endif /* ULTRIX_AUTH */ 
 
    if (logged_in || askpasswd == 0) { 
        reply(503, "Login with USER first."); 
        return; 
    } 
    askpasswd = 0; 
 
    /* Disable lreply() if the first character of the password is '-' since 
     * some hosts don't understand continuation messages and hang... */ 
 
    if (*passwd == '-') 
        dolreplies = 0; 
    else 
        dolreplies = 1; 
/* ******** REGULAR/GUEST USER PASSWORD PROCESSING ********** */ 
    if (!anonymous) {    /* "ftp" is only account allowed no password */ 
        if (*passwd == '-') 
            passwd++; 
#ifdef SHADOW_PASSWORD 
        if (pw) { 
           struct spwd *spw = getspnam( pw->pw_name ); 
           if (spw) { 
               /* TODO: check if password has expired etc.  */ 
               pw->pw_passwd = spw->sp_pwdp; 
           } 
#if 0  /* Shadow passwords are optional on Linux.  --marekm */ 
           else 
               pw->pw_passwd = ""; 
#endif 
/* marekm's fix for linux proc file system shadow passwd exposure problem */ 
       endspent(); 
        } 
#endif 
 
        *guestpw = '\0'; 
        if (pw == NULL) 
            salt = "xx"; 
        else 
            salt = pw->pw_passwd; 
#ifdef KERBEROS 
        xpasswd = crypt16(passwd, salt); 
#else 
#ifdef SKEY 
    xpasswd = skey_crypt(passwd, salt, pw, pwok); 
    pwok = 0; 
#else 
#ifdef SHADOW_PASSWORD 
        xpasswd = pw_encrypt(passwd, salt); 
#else 
        xpasswd = crypt(passwd, salt); 
#endif 
#endif 
#endif 
[ ... rest of function proceeds unimpared...] 
 
I hated to have to copy all of that, but this should be enough to give 
you a concise idea as to WHERE in the code you need to be. Note the 
block: 
 
#ifdef SHADOW_PASSWORD 
        xpasswd = pw_encrypt(passwd, salt); 
#else 
 
replacing pw_encrypt() with your crypt()-like function I discussed 
earlier and also replacing SHADOW_PASSWORD with a define of your own 
devising (ie MY_CRYPT) .. don't forget to add the "-DMY_CRYPT" to your 
CFLAGS section in ./Makefile!! :> 
 
Note: I do think that hacking the authentication code in this manner has 
the potential to open up security bugs. Be VERY careful about the 
function you use to authenticate. Of course, I'm probably being paranoid, 
but a lil paranoia never hurt anyone! :> 
 
That should be enough to get you going. If I have lost you, then drop me 
a line and I'll see if I can help out more. 
 
- Cliff  

========================================================================= 
= Clifton Wood       | "Tis better to worry for nothing than to not worry   
- Software Engineer  |  and meet Mr. Murphy when you are the least  
- TeleWorks, Inc.    |  unprepared for him." - Overheard at a bar.

---

From: "Marina Wefer" <[email-masked]>
Date: Wed, 6 Nov 1996 08:58:01 +0200

On  6 Nov 96 , [email-masked] wrote:

> ** Reply to note from [email-masked] Tue, 5 Nov 1996 09:04:55 -0600 (CST) 
> >    
> >    
> > Up to 8 character passwords is standard crypt() behaviour.  The only 
> > options I know of for extending that are to go to doublewide shadow 
> > passwords, but that seems to actually ease the process of breaking the 
> > encryption.  I know there are other schemes available for longer pass 
> > phrases, but they would require source hacks. 
> >    
> >    -- Michael 
>  
> Honestly? How is this possible? I thought that with an increase of 
> password size, you also increased the difficulty? Is this just with 
> the doublewide shadow implementation? 

Well, Michael is right.

Most Shadow suites enclose code for doubling the length of passwds to 
16 char's. The passwd-encryption-function (crypt) is based on 
DES-algorithm, where the key is a users passwd and the encoded string 
is NULL. 
Because of the behaviour of (crypt) DES-Experts don't recommend
doubling the length of passwd's. The encoding is simply applied first to the
left half and then to the right half of the longer passwd. Therefore 
it isn't more secure...

For futher information take a look at
'applied Cryptography: Protocols, Algorithms and Source Code in C'
by Bruce Schneier 

And this is not only with the doublewide shadow implementation.
There's work in progress to enhance the passwd authentication by 
using a more secure algorithm (MD5) and support for long passwd's.

Marina
-------- snip -------
Marina Wefer
Klinikum der Philipps-Universitaet Marburg
Institut fuer Med. Informatik
Bunsenstr. 3
35037 Marburg
Tel.: +49-6421-286393, email: [email-masked]