It's worth pointing out that your code assumes the old DES-based crypt algorithm, which is highly crackable with modern hardware. A lot of systems are switching to MD5 crypt (which uses special salts that start with "$1$") or eksblowfish ("$2x$"). You might experiment with your particular crypt function and see if it accepts salts of this form. 
> perl -e 'print crypt("foo",q[$1$bar$]), "\n"'
$1$bar$gJTJurciWk9pIaPpodyiw.
> perl -e 'print crypt("foo",q[$2x$bar$]), "\n"'
$2zJyhpjk3l9E

[download]
The output above is from a slackware system. It recognized "$1$bar$" as an MD5 salt, and kept the entire string in its output. However, it interpreted "$2x$bar$" as an old-style DES salt, and only kept the first two characters. If your system accepts both MD5 and DES crypted passwords (like mine), you want to make sure you're using MD5 -- John cracks DES 30 times faster than MD5 on my machine.

Here's a trick I've seen for generating salts. What do you think? 

$des_salt = substr(crypt(rand(), "aa"), -3, 2);
$md5_salt = '$1$' . substr(crypt(rand().rand(), '$1$aaaaaaaa$'), -9, 8
+) . '$';

[download]
This way, you don't need to include the details about crypt's output character set in your code. Why rand().rand()? Some rand implementations have a 32-bit internal state but only output 16 bits of randomness per call. (Notably, Solaris libc and whatever ActiveState for Win32 is built against both do this.)

Update: Tweak, tweak. Turns out the last byte of the crypted pass doesn't hold a full 6 bits of information, so avoid it. This doesn't make much difference with MD5 (since rand is never going to give you 48 bits of real information anyway), but it's a big hit against a DES-based salt.

In reply to Re: Re: Adduser & Crypt by no_slogan
in thread Adduser & Crypt by jimbobn

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.