[sork] RE: passwd (release 2.2) - Solaris, crypt(), MD5, DES,
vpopmail
Dennis Kisilyov
dennis at infoleak.com
Mon Sep 15 12:41:25 PDT 2003
My findings took me to vpopmail.c in vpopmail.
423 #ifdef MD5_PASSWORDS
424 salt[0] = '$';
425 salt[1] = '1';
426 salt[2] = '$';
427 salt[3] = randltr();
428 salt[4] = randltr();
429 salt[5] = randltr();
430 salt[6] = randltr();
431 salt[7] = randltr();
432 salt[8] = 0;
433 #else
434 salt[0] = randltr();
435 salt[1] = randltr();
436 salt[2] = 0;
437 #endif
This define behavior is controlled by a configure directive
--enable-md5-passwords=n \
Turning off this directive allowed me to create non $1$ salts with
vpopmail
This made php's crypt work properly whence not confused by $1 as a salt
in the pw_passwd field.
Now all that's left are minor alterations to get rid of '{crypt}' in the
password field after changing.
-DK
More information about the sork
mailing list