Georg Brandl | 116aa62 | 2007-08-15 14:28:22 +0000 | [diff] [blame] | 1 | :mod:`crypt` --- Function to check Unix passwords |
| 2 | ================================================= |
| 3 | |
| 4 | .. module:: crypt |
| 5 | :platform: Unix |
| 6 | :synopsis: The crypt() function used to check Unix passwords. |
| 7 | .. moduleauthor:: Steven D. Majewski <sdm7g@virginia.edu> |
| 8 | .. sectionauthor:: Steven D. Majewski <sdm7g@virginia.edu> |
| 9 | .. sectionauthor:: Peter Funk <pf@artcom-gmbh.de> |
| 10 | |
| 11 | |
| 12 | .. index:: |
| 13 | single: crypt(3) |
| 14 | pair: cipher; DES |
| 15 | |
| 16 | This module implements an interface to the :manpage:`crypt(3)` routine, which is |
| 17 | a one-way hash function based upon a modified DES algorithm; see the Unix man |
| 18 | page for further details. Possible uses include allowing Python scripts to |
| 19 | accept typed passwords from the user, or attempting to crack Unix passwords with |
| 20 | a dictionary. |
| 21 | |
| 22 | .. index:: single: crypt(3) |
| 23 | |
| 24 | Notice that the behavior of this module depends on the actual implementation of |
| 25 | the :manpage:`crypt(3)` routine in the running system. Therefore, any |
| 26 | extensions available on the current implementation will also be available on |
| 27 | this module. |
| 28 | |
| 29 | |
| 30 | .. function:: crypt(word, salt) |
| 31 | |
| 32 | *word* will usually be a user's password as typed at a prompt or in a graphical |
| 33 | interface. *salt* is usually a random two-character string which will be used |
| 34 | to perturb the DES algorithm in one of 4096 ways. The characters in *salt* must |
| 35 | be in the set ``[./a-zA-Z0-9]``. Returns the hashed password as a string, which |
| 36 | will be composed of characters from the same alphabet as the salt (the first two |
| 37 | characters represent the salt itself). |
| 38 | |
| 39 | .. index:: single: crypt(3) |
| 40 | |
| 41 | Since a few :manpage:`crypt(3)` extensions allow different values, with |
| 42 | different sizes in the *salt*, it is recommended to use the full crypted |
| 43 | password as salt when checking for a password. |
| 44 | |
| 45 | A simple example illustrating typical use:: |
| 46 | |
| 47 | import crypt, getpass, pwd |
| 48 | |
Georg Brandl | 116aa62 | 2007-08-15 14:28:22 +0000 | [diff] [blame] | 49 | def login(): |
Georg Brandl | 8d5c392 | 2007-12-02 22:48:17 +0000 | [diff] [blame] | 50 | username = input('Python login:') |
Georg Brandl | 116aa62 | 2007-08-15 14:28:22 +0000 | [diff] [blame] | 51 | cryptedpasswd = pwd.getpwnam(username)[1] |
| 52 | if cryptedpasswd: |
Georg Brandl | 48310cd | 2009-01-03 21:18:54 +0000 | [diff] [blame] | 53 | if cryptedpasswd == 'x' or cryptedpasswd == '*': |
Georg Brandl | 116aa62 | 2007-08-15 14:28:22 +0000 | [diff] [blame] | 54 | raise "Sorry, currently no support for shadow passwords" |
| 55 | cleartext = getpass.getpass() |
| 56 | return crypt.crypt(cleartext, cryptedpasswd) == cryptedpasswd |
| 57 | else: |
| 58 | return 1 |
| 59 | |