[Da-tools-commits] ./debian/userdir-ldap-cgi r107: Add password checking via a python wrapper
Peter Palfrader
peter at palfrader.org
Mon Sep 15 12:25:48 UTC 2008
------------------------------------------------------------
revno: 107
committer: Peter Palfrader <peter at palfrader.org>
branch nick: userdir-ldap-cgi
timestamp: Mon 2008-09-15 14:25:48 +0200
message:
Add password checking via a python wrapper
added:
password-qualify-check
modified:
debian/changelog
debian/control
debian/rules
-------------- next part --------------
=== modified file 'debian/changelog'
--- a/debian/changelog 2008-09-14 22:48:37 +0000
+++ b/debian/changelog 2008-09-15 12:25:48 +0000
@@ -1,3 +1,9 @@
+userdir-ldap-cgi (0.3.18) unstable; urgency=low
+
+ * Add password checking via a python wrapper.
+
+ -- Peter Palfrader <weasel at debian.org> Mon, 15 Sep 2008 14:25:44 +0200
+
userdir-ldap-cgi (0.3.17) unstable; urgency=low
* Comment out uuid - nobody will get it's just an identifier.
=== modified file 'debian/control'
--- a/debian/control 2008-09-14 21:59:44 +0000
+++ b/debian/control 2008-09-15 12:25:48 +0000
@@ -8,7 +8,8 @@
Package: userdir-ldap-cgi
Architecture: all
-Depends: userdir-ldap, perl5, libnet-ldap-perl, libcrypt-blowfish-perl, gnupg (>= 1.0.3), libdate-manip-perl, liburi-perl, libio-socket-ssl-perl, libossp-uuid-perl, libdigest-hmac-perl
+Depends: userdir-ldap, perl5, libnet-ldap-perl, libcrypt-blowfish-perl, gnupg (>= 1.0.3), libdate-manip-perl, liburi-perl, libio-socket-ssl-perl, libossp-uuid-perl, libdigest-hmac-perl, python, python-crack, cracklib-runtime
+Recommends: wamerican, wamerican-large, wamerican-small, wbritish, wbritish-large, wbritish-small, wbulgarian, wcanadian, wcanadian-large, wcanadian-small, wcatalan, wdanish, wdutch, wfaroese, wfinnish, wfrench, wgalician-minimos, witalian, wngerman, wnorwegian, wogerman, wpolish, wspanish, wswedish, wswiss, wukrainian
Replaces: userdir-ldap
Description: CGI programs for the db.debian.org
These programs are run on http://db.debian.org/ to simplify the
=== modified file 'debian/rules'
--- a/debian/rules 2006-12-22 08:13:31 +0000
+++ b/debian/rules 2008-09-15 12:25:48 +0000
@@ -19,7 +19,8 @@
var/www/userdir-ldap \
var/cache/userdir-ldap/web-cookies \
var/cache/userdir-ldap/hosts \
- usr/share/doc/$(package)
+ usr/share/doc/$(package) \
+ usr/lib/userdir-ldap-cgi
binary-indep: build
dh_testdir
@@ -33,6 +34,8 @@
chown www-data:www-data $(i)/var/cache/userdir-ldap/web-cookies/
chmod u=rwx,g=,o= $(i)/var/cache/userdir-ldap/web-cookies/
+ install -m 755 password-qualify-check $(i)/usr/lib/userdir-ldap-cgi
+
install -m 644 apache-config.txt $(i)/usr/share/doc/$(package)
dh_installchangelogs
=== added file 'password-qualify-check'
--- a/password-qualify-check 1970-01-01 00:00:00 +0000
+++ b/password-qualify-check 2008-09-15 12:25:48 +0000
@@ -0,0 +1,72 @@
+#!/usr/bin/python
+
+# check password quality using cracklib given a new password, optionally the
+# old password, and a list of ldap/gecos words via stdin, each on a line by
+# itself (send an empty line if you want to skip the old password check)
+
+# Copyright (c) 2008 Peter Palfrader
+
+import crack, sys, tempfile, os
+
+def cleanup(dir):
+ if not dir.startswith('/tmp/pwcheck-'):
+ raise ValueError, 'cleanup got a weird dir to remove: '+dir
+ for f in 'dict.hwm dict.pwd dict.pwi wordlist wordlist-cleaned'.split(' '):
+ p = dir+'/'+f
+ if os.path.exists(p):
+ os.remove(p)
+ if os.path.exists(dir):
+ os.rmdir(dir)
+
+
+
+newpass = sys.stdin.readline().strip()
+oldpass = sys.stdin.readline().strip()
+ldapwords = map( lambda x: x.strip(), sys.stdin.readlines())
+
+if oldpass == "":
+ oldpass = None
+
+
+crack.min_length = 11
+
+# check against the default dictionary
+try:
+ crack.VeryFascistCheck(newpass, oldpass)
+except ValueError, e:
+ print e
+ sys.exit(1)
+
+# and against a dictionary created from the ldap info on this user
+if len(ldapwords) > 0:
+ tmpdir = tempfile.mkdtemp('', 'pwcheck-')
+ F = open(tmpdir+'/wordlist', "w")
+ for w in ldapwords:
+ F.write(w+"\n");
+ for w1 in ldapwords:
+ for w2 in ldapwords:
+ F.write(w1+w2+"\n");
+ F.write(w1[0]+w2+"\n");
+ F.close()
+
+ r = os.system("/usr/sbin/crack_mkdict "+tmpdir+"/wordlist > "+tmpdir+"/wordlist-cleaned")
+ if r != 0:
+ print "crack_mkdict returned non-zero exit status %d."%(r)
+ cleanup(tmpdir)
+ sys.exit(1)
+ r = os.system("/usr/sbin/crack_packer "+tmpdir+"/dict < "+tmpdir+"/wordlist-cleaned > /dev/null")
+ if r != 0:
+ print "crack_packer returned non-zero exit status %d."%(r)
+ cleanup(tmpdir)
+ sys.exit(1)
+
+ try:
+ crack.VeryFascistCheck(newpass, None, tmpdir+"/dict")
+ except ValueError, e:
+ print "ldap data based check: "+str(e)
+ cleanup(tmpdir)
+ sys.exit(1)
+
+ cleanup(tmpdir)
+
+sys.exit(0)
More information about the Da-tools-commits
mailing list