2 # ====================================================================
3 # The Apache Software License, Version 1.1
5 # Copyright (c) 2000-2003 The Apache Software Foundation. All rights
8 # Redistribution and use in source and binary forms, with or without
9 # modification, are permitted provided that the following conditions
12 # 1. Redistributions of source code must retain the above copyright
13 # notice, this list of conditions and the following disclaimer.
15 # 2. Redistributions in binary form must reproduce the above copyright
16 # notice, this list of conditions and the following disclaimer in
17 # the documentation and/or other materials provided with the
20 # 3. The end-user documentation included with the redistribution,
21 # if any, must include the following acknowledgment:
22 # "This product includes software developed by the
23 # Apache Software Foundation (http://www.apache.org/)."
24 # Alternately, this acknowledgment may appear in the software itself,
25 # if and wherever such third-party acknowledgments normally appear.
27 # 4. The names "Apache" and "Apache Software Foundation" must
28 # not be used to endorse or promote products derived from this
29 # software without prior written permission. For written
30 # permission, please contact apache@apache.org.
32 # 5. Products derived from this software may not be called "Apache",
33 # nor may "Apache" appear in their name, without prior written
34 # permission of the Apache Software Foundation.
36 # THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
37 # WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
38 # OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
39 # DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
40 # ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
41 # SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
42 # LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
43 # USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
44 # ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
45 # OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
46 # OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
48 # ====================================================================
50 # This software consists of voluntary contributions made by many
51 # individuals on behalf of the Apache Software Foundation. For more
52 # information on the Apache Software Foundation, please see
53 # <http://www.apache.org/>.
56 #for more functionality see the HTTPD::UserAdmin module:
57 # http://www.perl.com/CPAN/modules/by-module/HTTPD/HTTPD-Tools-x.xx.tar.gz
59 # usage: dbmmanage <DBMfile> <command> <user> <password> <groups> <comment>
62 # -ldb -lndbm -lgdbm -lsdbm
63 BEGIN { @AnyDBM_File::ISA = qw(DB_File NDBM_File GDBM_File SDBM_File) }
69 my $cmds = join "|", sort keys %dbmc::;
71 Usage: dbmmanage [enc] dbname command [username [pw [group[,group] [comment]]]]
73 where enc is -d for crypt encryption (default except on Win32, Netware)
74 -m for MD5 encryption (default on Win32, Netware)
75 -s for SHA1 encryption
78 command is one of: $cmds
80 pw of . for update command retains the old password
81 pw of - (or blank) for update command prompts for the password
83 groups or comment of . (or blank) for update command retains old values
84 groups or comment of - for update command clears the existing value
85 groups or comment of - for add and adduser commands is the empty value
90 if (!eval ('require "Digest/SHA1.pm";')) {
91 print STDERR <<SHAERR;
92 dbmmanage SHA1 passwords require the interface or the module Digest::SHA1
95 http://www.cpan.org/modules/by-module/Digest/Digest-MD5-2.12.tar.gz
97 Please install Digest::SHA1 and try again, or use a different crypt option:
105 if (!eval ('require "Crypt/PasswdMD5.pm";')) {
106 print STDERR <<MD5ERR;
107 dbmmanage MD5 passwords require the module Crypt::PasswdMD5 available from CPAN
109 http://www.cpan.org/modules/by-module/Crypt/Crypt-PasswdMD5-1.1.tar.gz
111 Please install Crypt::PasswdMD5 and try again, or use a different crypt option:
118 # if your osname is in $newstyle_salt, then use new style salt (starts with '_' and contains
119 # four bytes of iteration count and four bytes of salt). Otherwise, just use
120 # the traditional two-byte salt.
121 # see the man page on your system to decide if you have a newer crypt() lib.
122 # I believe that 4.4BSD derived systems do (at least BSD/OS 2.0 does).
123 # The new style crypt() allows up to 20 characters of the password to be
124 # significant rather than only 8.
126 my $newstyle_salt_platforms = join '|', qw{bsdos}; #others?
127 my $newstyle_salt = $^O =~ /(?:$newstyle_salt_platforms)/;
129 # Some platforms just can't crypt() for Apache
131 my $crypt_not_supported_platforms = join '|', qw{MSWin32 NetWare}; #others?
132 my $crypt_not_supported = $^O =~ /(?:$crypt_not_supported_platforms)/;
134 my $crypt_method = "crypt";
136 if ($crypt_not_supported) {
137 $crypt_method = "md5";
140 # Some platforms won't jump through our favorite hoops
142 my $not_unix_platforms = join '|', qw{MSWin32 NetWare}; #others?
143 my $not_unix = $^O =~ /(?:$not_unix_platforms)/;
145 if ($crypt_not_supported) {
146 $crypt_method = "md5";
149 if (@ARGV[0] eq "-d") {
151 if ($crypt_not_supported) {
153 "Warning: Apache/$^O does not support crypt()ed passwords!\n\n";
155 $crypt_method = "crypt";
158 if (@ARGV[0] eq "-m") {
160 $crypt_method = "md5";
163 if (@ARGV[0] eq "-p") {
165 if (!$crypt_not_supported) {
167 "Warning: Apache/$^O does not support plaintext passwords!\n\n";
169 $crypt_method = "plain";
172 if (@ARGV[0] eq "-s") {
175 $crypt_method = "sha1";
178 if ($crypt_method eq "md5") {
182 my($file,$command,$key,$crypted_pwd,$groups,$comment) = @ARGV;
184 usage() unless $file and $command and defined &{$dbmc::{$command}};
186 # remove extension if any
187 my $chop = join '|', qw{db.? pag dir};
188 $file =~ s/\.($chop)$//;
190 my $is_update = $command eq "update";
193 my($mode, $flags) = $command =~
194 /^(?:view|check)$/ ? (0644, O_RDONLY) : (0644, O_RDWR|O_CREAT);
196 tie (%DB, "AnyDBM_File", $file, $flags, $mode) || die "Can't tie $file: $!";
205 srand (time ^ $$ or time ^ ($$ + ($$ << 15)));
208 for (qw(-xlwwa -le)) {
210 $psf = $_, last unless $?;
212 srand (time ^ $$ ^ unpack("%L*", `ps $psf | gzip -f`));
214 @range = (qw(. /), '0'..'9','a'..'z','A'..'Z');
215 $x = int scalar @range;
219 join '', map $range[rand $x], 1..shift||1;
223 genseed() unless @range;
224 return $newstyle_salt ?
225 join '', "_", randchar, "a..", randchar(4) :
230 my ($pw, $salt) = @_;
231 $salt = saltpw_crypt unless $salt;
236 genseed() unless @range;
242 $salt = saltpw_md5 unless $salt;
243 Crypt::PasswdMD5::apache_md5_crypt($pw, $salt);
248 '{SHA}' . Digest::SHA1::sha1_base64($pw) . "=";
252 if ($crypt_method eq "md5") {
253 return cryptpw_md5(@_);
254 } elsif ($crypt_method eq "sha1") {
255 return cryptpw_sha1(@_);
256 } elsif ($crypt_method eq "crypt") {
257 return cryptpw_crypt(@_);
259 @_[0]; # otherwise return plaintext
263 my $prompt = shift || "Enter password:";
266 open STDIN, "/dev/tty" or warn "couldn't open /dev/tty $!\n";
267 system "stty -echo;";
271 print STDERR $prompt;
272 while (($c = getc(STDIN)) ne '' and $c ne "\n" and $c ne "\r") {
276 system "stty echo" unless $not_unix;
278 die "Can't use empty password!\n" unless length $pwd;
283 die "Sorry, user `$key' doesn't exist!\n" unless $DB{$key};
284 $crypted_pwd = (split /:/, $DB{$key}, 3)[0] if $crypted_pwd eq '.';
285 $groups = (split /:/, $DB{$key}, 3)[1] if !$groups || $groups eq '.';
286 $comment = (split /:/, $DB{$key}, 3)[2] if !$comment || $comment eq '.';
287 if (!$crypted_pwd || $crypted_pwd eq '-') {
296 die "Can't use empty password!\n" unless $crypted_pwd;
298 die "Sorry, user `$key' already exists!\n" if $DB{$key};
300 $groups = '' if $groups eq '-';
301 $comment = '' if $comment eq '-';
302 $groups .= ":" . $comment if $comment;
303 $crypted_pwd .= ":" . $groups if $groups;
304 $DB{$key} = $crypted_pwd;
305 my $action = $is_update ? "updated" : "added";
306 print "User $key $action with password encrypted to $DB{$key} using $crypt_method\n";
310 my $value = getpass "New password:";
311 die "They don't match, sorry.\n" unless getpass("Re-type new password:") eq $value;
312 $crypted_pwd = cryptpw $value;
317 die "Sorry, user `$key' doesn't exist!\n" unless $DB{$key};
318 delete $DB{$key}, print "`$key' deleted\n";
322 print $key ? "$key:$DB{$key}\n" : map { "$_:$DB{$_}\n" if $DB{$_} } keys %DB;
326 die "Sorry, user `$key' doesn't exist!\n" unless $DB{$key};
327 my $chkpass = (split /:/, $DB{$key}, 3)[0];
328 my $testpass = getpass();
329 if (substr($chkpass, 0, 6) eq '$apr1$') {
331 $crypt_method = "md5";
332 } elsif (substr($chkpass, 0, 5) eq '{SHA}') {
334 $crypt_method = "sha1";
335 } elsif (length($chkpass) == 13 && $chkpass ne $testpass) {
336 $crypt_method = "crypt";
338 $crypt_method = "plain";
340 print $crypt_method . (cryptpw($testpass, $chkpass) eq $chkpass
341 ? " password ok\n" : " password mismatch\n");
345 while(defined($_ = <STDIN>) and chomp) {
346 ($key,$crypted_pwd,$groups,$comment) = split /:/, $_, 4;