tyler.durden
/
pandorafms
mirror of https://github.com/pandorafms/pandorafms.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fixed passwords encryption

This commit is contained in:
Enrique Martin 2023-10-05 10:57:03 +02:00
parent f86a117e30
commit 5a7aa609a7
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
pandora_agents/unix/plugins/pandora_security_check
View File

@ -534,10 +534,11 @@ if check_passwords==1:
for line in shadow_file: for line in shadow_file:
username, password_hash, *_ = line.strip().split(':') username, password_hash, *_ = line.strip().split(':')
# Skip users with no password hash or system users # Skip users with no password hash
if password_hash != "*" and username not in ["nobody", "root", "daemon"]: if password_hash != "*" and password_hash != "!!" and password_hash != "!locked":
for weak_password in l_passwords: for weak_password in l_passwords:
weak_password_hash = crypt.crypt(weak_password, password_hash[:2]) weak_password_hash = crypt.crypt(weak_password, password_hash[:password_hash.rfind('$')])
if weak_password_hash == password_hash: if weak_password_hash == password_hash:
insecure_users.append(username) insecure_users.append(username)
break break