You didn't say if you want to check the password for a local or remote host.
The other responses provide useful advice to validate the password by trying to
access a remote system.
However, it is not a good idea to allow root access at all. Consider to disable remote root access
(see PermitRootLogin in sshd_config).
Instead, login using a non-privileged account and then check the root password locally - as described by rovf and marto.
If you want to check the root password locally, it would be nice to just mill the
password and the salt through crypt and compare the result with the hashed password.
However, on most systems, you need root privileges to access /etc/shadow in order to get the
necessary information. Furthermore, some (most?) systems doesn't use crypt anymore.
Update: Well, seems that crypt is smart enough to handle a variety of hash algorithms.
However, on systems that store hashes in /etc/shadow, privileged access is still required -
even for validation. The script below works - at least here - with any non-privileged account.
.oO(always thought there is a program or library-call to validate passwords - but couldn't find one - other monks will know...)
use strict; use warnings; use IPC::Open2; chomp(my $pwd = <>); my($chld_out, $chld_in); my $phrase = quotemeta "lookatme-i-am-roy"; my $pid = open2($chld_out, $chld_in, '/bin/su -c echo\\ ' . $phrase . ' 2>&1'); print $chld_in $pwd , "\n"; my $outcome = grep(/$phrase/, <$chld_out>); print "Password is ", $outcome ? "*valid*\n" : "not correct!\n"; waitpid($pid, 0);
It tries to run a single echo command after successfully switching user. The script checks for the expected output.
HTHIn reply to Re: script to verify password
by Perlbotics
in thread script to verify password
by perldesire
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |