You can actually use pam to uthenticate as a normal user. You never get to see the encrypted password, but the pam lib tells you whether the password you are giving is right or not. Here is a quick example (cut & paste from the Authen::PAM perldocs):

#!/usr/bin/perl -w

use strict;

use Authen::PAM;

my $login_name = getpwuid($<);

sub conversation {
    my @res;
    while ( @_ ) {
    my $msg_type = shift;
    my $msg = shift;
    
    my $ans = "put your password here";
    push @res, (0,$ans);
    }
    push @res, PAM_SUCCESS();
    return @res;
}


my $pamh;
pam_start("passwd", $login_name, \&conversation, $pamh);
print pam_authenticate($pamh);
pam_end($pamh);
[download]

Yes you can. Try with the following, which is a cleaned-up version of my previous post:

#!/usr/bin/perl -w

#------------------------------------------------------------
# Usage: pwdcheck login password
#------------------------------------------------------------

use strict;
use Authen::PAM;

#----------------------------------------
# isValid ( user, pass ))
# check whether the user/pass combo is valid
#----------------------------------------
sub isValid {
    my ( $login, $pass ) = @_;
    my $pamh;
    pam_start( "passwd", $login,
           sub { ( ( 0, $pass ) x (@_/2), PAM_SUCCESS() ) },
           $pamh );
    my $res = pam_authenticate($pamh) == PAM_SUCCESS();
    pam_end($pamh);
    return $res;
}

my ( $login, $pass ) = @ARGV;
print isValid ( $login, $pass );
[download]

As you can see, by invoking it as unprivileged user as script username password it prints 1 if the login/pass combo is a valid (unix) one, while it waits a couple of seconds and exits silently otherwise. You can use the isValid function in your cgi script without needing root privileges.
Cheers

Antonio


The stupider the astronaut, the easier it is to win the trip to Vega - A. Tucket