I would use Expect.pm to communicate with your system's passwd program, which always knows which kind of hash to use, and which may be PAM-enabled to update the password in more places that just /etc/shadow.

Working example code, loosely tested (needs more error checking).

#!/usr/bin/perl -w
use strict;
use Expect;
my @user_pass_pairs = (
  [ qw( Tarzan Ungowa    ) ],
  [ qw( Jane   GoneNative) ],
);
# Time out if we don't get responses within 5 seconds.
my $timeout = 5;
foreach (@user_pass_pairs) {
  my ($user, $pass) = @$_;
  system('useradd', $username) == 0 or die;
  my $xp = Expect->spawn("passwd $user") or die;

  $xp->expect($timeout,"New UNIX password: ") or die;
  print $xp "$pass\r";
  
  $xp->expect($timeout,"Retype new UNIX password: ") or die;
  print $xp "$pass\r";

  $xp->expect(
    $timeout,"passwd: all authentication tokens updated successfully."
  ) or die;

}
[download]

In previous questions, some notable other suggestions were:

• Crypt::PasswdMD5
• Digest::MD5
• IO::Tty

• /usr/bin/passwd
• MD5 /etc/passwd-style hashes?
• shadow passwd

my @chars = ('a'..'z', 'A'..'Z', 0..9);
my $password = do {{
  local $_ = join "" => map {$chars [rand @chars]} 1..8;
  redo unless /[a-z]/ && /[A-Z]/ && /\d/;
  $_;
}};
my $salt = '$1$' . join '',
   ('.', '/', 0..9,
   'A'..'Z', 'a'..'z')[ map { int rand 64 } 0 .. 7 ];
my $encrypted_pass = crypt($password, $salt);
[download]

If you just want to add one user at a time as root, just separate the steps:

# useradd joe
# passwd joe
New Password: *****
[download]

But you're asking about the way to automate it.

The /etc/shadow file takes multiple hashing formats for passwords. (Encryption is a misnomer; encryption can be reversed but hashing cannot.) There's crypt() as you've tried, and there's MD5 and a few other hashing functions. The system knows the difference based on the first couple characters. (You didn't cut and paste your shadow example literally, since your crypt() function would not have begun with a '$1'.)

Although you can get such hashes from the command line:

# openssl passwd -salt '$1' 'mypassword'
$1XahR1gy5QBc
# openssl passwd -apr1 -salt '$1' 'mypasswd'
$apr1$$1$WU93LWav20QAwX/j3i0CW/
[download]

I hope other monks can discuss what's necessary for a script to use a module (maybe Digest::MD5) to properly hash and encode the type and hash for /etc/shadow.

--
[ e d @ h a l l e y . c c ]

The Linux passwd supports the --stdin option to read the password from stdin. This should be easy to automate with Perl. Using passwd means that PAM handles changing the password and it knows the current configuration of shadow, MD5, etc.

system("useradd $user");
open PASSWD, "| passwd --stdin $user";
print PASSWD $password;
close PASSWD;
[download]

Try using Crypt::Passwd or Crypt::PasswdMD5 to generate the hashed password. The salt bytes are *very* important, as these protect your passwords from pre-computed hash lists. Use random bytes for these (Math::TrulyRandom comes to mind).

Best regards

-lem, but some call me fokat

is it possible to do this then:

my $epassword = `openssl passwd -apr1 -salt '$1' '$password'`;



!system ('useradd', '-g', 'users',
                    '-d', "/home/$username",
                    '-p', $epassword,
                    '-s', '/bin/false',
                    '-c', $fullname,
                    $username) or die "Creation of User Failed";
[download]

I would seriously consider Util's (++) suggestion about using Expect. His point about PAM and hashing algorythm is worthy of examination, IMHO. This also makes the solution more portable, as generally passwd has a very similar behavior among systems. This is not true for useradd or adduser.

Best regards

-lem, but some call me fokat

As far as security goes, the type of hash is not as important as selecting good passwords. Fully random noise is not as good as you might think.

Your script generates random passwords, and that's useful for the initial user password. However, they should be required to change it to something of their choice immediately for two reasons: (1) they won't remember something random you gave them without writing it down, and (2) you absolve some theoretical liability for breakins after they change it from your password to theirs.

--
[ e d @ h a l l e y . c c ]

# Random seed from p.223 of _Programming Perl_ (O'Reilly & Assoc)
srand(time() ^ ($$ + ($$ << 15)) );
@saltchars=(a..z,A..Z,0..9,'.','/');        # valid salt chars
$salt=$saltchars[int(rand($#saltchars+1))];    # first random salt cha
+r
$salt.=$saltchars[int(rand($#saltchars+1))];    # second random salt c
+har
$cpw = crypt($pass,$salt);
[download]

Richard

There are three types of people in this world, those that can count and those that cannot. Anon