Conference turris::digital_unix

I'm not a security expert but I think you need to use sia_chg_passwd 
function. See the Digtial UNIX Security docs for more information. 
The put/get style interfaces are at a lower level. You 
would have to generate the encrypted password and then call these routines. 
That can be tricky in C2 cause there are multiple encryption alorgithms
to choose from (i.e. you'd have to use the same one that the user's
account was configured to use).  

If your application is a GUI, you might be able to 
fork off /usr/tcb/bin/dxchpwd. This is a GUI interface for a user to 
change his password. Note that there is a bad bug in this GUI on V4.0
systems so you'd need a patch in order to use it. This would not 
let you set and application specific password however. 

		Pete

                     <<< Note 8579.0 by DOOSJE::HERTA "For something fulfilled this hour, loved, or endured" >>>
                                -< how to update passwd from C program (Enhanced Security + NIS)? >-

    Take a look at 582.2. Mulp posted a permutation of one of my programs
    that contains among other things the code that you need. If it isn't
    enough, I should have a later version lying around someplace.
    
    	Yaacov

Re:.1 - Pete Wolfe
> I'm not a security expert but I think you need to use sia_chg_passwd 
I'm not an expert either, but from the documentation, it looks like sia*
only works on the traditional UNIX /etc/passwd file.  

> That can be tricky in C2 cause there are multiple encryption alorgithms
> to choose from (i.e. you'd have to use the same one that the user's
> account was configured to use).
What is the default algorithm when you set up enhanced security?  Or do we need 
to know it?  While most of the users will be dropped directly into the 
application, we will have some with shell access.  Potentially, these users
will change their password both from shell and from the application change-
password module.

> If your application is a GUI, you might be able to 
Nope.  It's character-cell interface.  We might call out to /usr/bin/passwd, but
I was hoping for a cleaner program.

Re:.2 - Yaacov Fenster 
> Take a look at 582.2.
I took a look at the program, and while it could be very helpful in writing 
our own, it leaves me with the problem mentioned above, i.e., what is the default 
"salt" value used by enhanced security?

Thanks for both answers so far.

Herta

>I'm not an expert either, but from the documentation, it looks like sia*
>only works on the traditional UNIX /etc/passwd file.  

No, the sia interface is designed with work with all the security interfaces
on the system - it's the lowest level api that the upper security layers
are built on (base, C2, DCE, etc). 

>What is the default algorithm when you set up enhanced security?  
Not sure but I think it's BigCrypt. 

>Or do we need to know it?  
A program that sets the user's encytped passwd needs to know. 

>our own, it leaves me with the problem mentioned above, i.e., what is the default 
>"salt" value used by enhanced security?

That program is simply creating new accounts and setting the initial password
using crypt. Do a man 3 crypt to see what the salt characters are. 

I still think you want to be using the sia_chg_password routine... I am 
also hoping that the real security types will jump in at this point :-)

			Pete

To write a program that changes a user's password for Enhanced Security, the 
easiest thing to do is to use sia_chg_password(3).  sia_chg_password will 
work with either Enhanced Security or Base Security and it will also work 
over NIS.  sia_chg_password should do the whole thing, prompting for
old and new password, encrypting the new password, and storing it in the
proper database.  You should be able to use sia_collect_trm(3) as the 
collection routine, or you can code your own collection routine using 
sia_collect_trm as a template.

You could also just exec /usr/bin/passwd. 
[Posted by WWW Notes gateway]