shell – Useradd使用密码密码生成

发布时间：2020-12-15 18:52:14 所属栏目：安全来源：网络整理

导读：我正在研究我以为是一个非常简单的脚本来动态地创建一个使用’useradd’的FTP用户这个过程的几个部分我不熟悉,整整一天的研究没有让我太远.这是我有的： password="pass"pass=$(perl -e 'print crypt($ARGV[0],"wtf")' $password)useradd -d HOME_DIR -s /bi

我正在研究我以为是一个非常简单的脚本来动态地创建一个使用’useradd’的FTP用户这个过程的几个部分我不熟悉,整整一天的研究没有让我太远.这是我有的：

password="pass"
pass=$(perl -e 'print crypt($ARGV[0],"wtf")' $password)
useradd -d HOME_DIR -s /bin/bash -g GROUP -p $pass -f -1 testing

笔记

HOME_DIR和GROUP是占位符
>我没有与’useradd’的home / base_dir(-d,-b)或组(-g)功能有关的问题

主题：

为什么我的密码生成工作不起作用？
>是/ bin / bash正确的shell用于纯FTP用户,还是使用/ bin / false或不同的shell？
>默认情况下,useradd会禁用帐户,直到他们提供自己的密码,我该如何避免这种情况？
>我不想使用passwd实用程序,因为它削弱了我自动生成FTP帐户的能力,我找到了一个这个here的解决方案,但是我不明白解决方案

让我知道,如果我正在做这一切都是错误的,或者我想要做的是不可能的,或者我对这里所说的任何事情都是错误的.感谢您提供的任何帮助. ：D

关于密码生成：

07000

Function: char * crypt (const char *key,const char *salt)

The crypt function takes a password,key,as a string,and a salt character array which is described below,and returns a printable ASCII string which starts with another salt. It is believed that,given the output of the function,the best way to find a key that will produce that output is to guess values of key until the original value of key is found.

The salt parameter does two things. Firstly,it selects which algorithm is used,the MD5-based one or the DES-based one. Secondly,it makes life harder for someone trying to guess passwords against a file containing many passwords; without a salt,an intruder can make a guess,run crypt on it once,and compare the result with all the passwords. With a salt,the intruder must run crypt once for each different salt.

For the MD5-based algorithm,the salt should consist of the string $1$ ,followed by up to 8 characters,terminated by either another $ or the end of the string. The result of crypt will be the salt,followed by a $ if the salt didn’t end with one,followed by 22 characters from the alphabet ./0-9A-Za-z,up to 34 characters total. Every character in the key is significant.

For the DES-based algorithm,the salt should consist of two characters from the alphabet ./0-9A-Za-z,and the result of crypt will be those two characters followed by 11 more from the same alphabet,13 in total. Only the first 8 characters in the key are significant.

The MD5-based algorithm has no limit on the useful length of the password used,and is slightly more secure. It is therefore preferred over the DES-based algorithm.

When the user enters their password for the first time,the salt should be set to a new string which is reasonably random. To verify a password against the result of a previous call to crypt,pass the result of the previous call as the salt.

根据您的系统,还可能存在Blowfish或SHA-2家族隐窝,传统DES可能因为安全而被禁用. PAM可以在这里添加自己的并发症.

     ID       |    Method
  -------------------------------
     1        |  MD5 (Linux,BSD)
     2a       |  Blowfish (OpenBSD)
     md5      |  Sun MD5
     5        |  SHA-256 (Linux,since glibc 2.7)
     6        |  SHA-512 (Linux,since glibc 2.7)

就这样说了

root# useradd -d / -g users -p $(perl -e'print crypt("foo","aa")') -M -N foo
user$su - foo
Password: foo
foo$^D
root# userdel foo

在我的系统上工作很好.

关于壳：

/ sbin / nologin是传统的用于登录禁用的用户.您将必须仔细检查您的FTP守护程序的配置,以查看是否将其从FTP访问中排除.

关于残疾人帐户：

如上所述,为我工作,如果给定一个工作密码,如预期.

关于其他解决方案：

你不了解替代解决方案？对我来说似乎很清楚

只需将“username：password”添加到“chpasswd”中.

如果您只想使用FTP,我建议您使用支持像glftpd,Pure-FTPd,ProFTPD,vsftpd等虚拟用户的FTP守护进程,实际上似乎所有常见的用户.这样一来,FTP帐户就不需要真正的系统帐号.

（编辑：李大同）

【声明】本站内容均来自网络，其相关言论仅代表作者个人观点，不代表本站立场。若无意侵犯到您的权利，请及时与联系站长删除相关内容!