Removed interactive mode (is default now), moved some code to checkpw.h and many fixes.

LICENSE

@@ -1,4 +1,4 @@
-Copyright 2024 Johannes Findeisen <you@hanez.org>
+Copyright 2024 Johannes Findeisen
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

Makefile

@@ -6,7 +6,9 @@ clean:
 
 install:
 	cp ./checkpw /usr/bin/
+	cp ./checkpw.h /usr/include/
 
 uninstall:
 	rm -f /usr/bin/checkpw
+	rm -f /usr/include/checkpw.h
 

README.md

@@ -4,84 +4,96 @@ checkpw is a program that checks the validity of a users password on a UNIX/PAM-
 
 Currently only tested on Linux, but it should work on the [AIX](https://en.wikipedia.org/wiki/IBM_AIX), [DragonFly BSD](https://www.dragonflybsd.org/), [FreeBSD](https://www.freebsd.org/), [HP-UX](https://en.wikipedia.org/wiki/HP-UX), [Linux](https://kernel.org/), [macOS](https://en.wikipedia.org/wiki/MacOS), [NetBSD](https://netbsd.org/) and [Solaris](https://en.wikipedia.org/wiki/Oracle_Solaris) operating system too.
 
-## The idea behind:
+## The idea
 
-I needed a program to verify passwords of users on Linux based systems using PAM.
+I needed a program to verify passwords of users on Linux/UNIX systems using PAM that just return 0 on success and 1 on error.
 
-Exactly a program like this... not more!
+## Building checkpw
-
-## Installation:
-
-**WARNING:** Install this software with care. checkpw could easily be used for bruteforcing passwords from local users!
 
 ```
 git clone https://git.xw3.org/xw3/checkpw.git
 cd checkpw
 make
-sudo make install
 ```
 
-The code only supports verifying passwords for user id 1000 by default. Look a the code for some compile time options!
+The code only supports verifying passwords for user id 1000 by default. Look at the file checkpw.h for some compile time options!
 
-### Manual installation:
+### Custom build example
 
-Set MAX_UID and MIN_UID in the code or you can compile checkpw without editing the code using the following command and install it manually:
+Set MAX_UID and MIN_UID at compile time:
 
 ```
 gcc -Wall -DMAX_UID=1000 -DMIN_UID=1000 -o checkpw checkpw.c -lpam -lpam_misc
-sudo cp ./checkpw /usr/bin/
 ```
 
-## Uninstall:
+## Installation
+
+**WARNING:** Install this software with care. checkpw could easily be used for bruteforcing passwords from local users!
+
+```
+sudo make install
+```
+
+checkpw is installed to /usr/bin/.
+
+checkpw.h is installed to /usr/include/ for use in other applications.
+
+## Uninstall
 
 ```
 sudo make uninstall
 ```
 
-## Usage:
+## Usage
 
 ```
 checkpw -h
-Usage: checkpw [-u <username>] [-p <password>] [-i] [-v] [-h]
+Usage: checkpw [-u <username>] [-p <password>] [-v] [-V] [-h]
 
 Options:
   -u <username>  Specify username.
   -p <password>  Specify password.
-  -i             Enable interactive mode to prompt for missing username/password.
   -v             Enable verbose mode.
-  -V             Show program version.
+  -V             Print program version.
   -h             Show this help.
 ```
 
-Returns 0 on success, 1 otherwise.
+You can also use checkpw even without installing by just running the following command:
-
-### Examples:
-
-#### Interactive mode:
 
 ```
-checkpw -i
+./checkpk
 ```
 
-#### Interactive mode only asking for a password:
+checkpw returns 0 on success, 1 otherwise.
+
+### Examples
+
+
+#### Interactive mode asking for a username and a password
 
 ```
-checkpw -u hanez -i
+checkpw
 ```
 
-#### None interactive mode with username and password provided as arguments to checkpw:
+#### Interactive mode only asking for a password
+
+```
+checkpw -u hanez
+```
+
+#### None interactive mode with username and password provided as arguments to checkpw
 
 ```
 checkpw -u hanez -p password
 ```
 
-#### Request the result from the above commands:
+#### Request the result from the above commands
 
 ```
 echo $?
 ```
 
-## Links:
+## Links
 
  - [https://cr.yp.to/checkpwd.html](https://cr.yp.to/checkpwd.html)
  - [https://pamtester.sourceforge.net/](https://pamtester.sourceforge.net/)

checkpw.c

@@ -1,119 +1,23 @@
 /**
  * checkpw is a program that checks the validity of a users password on a
- * Linux/PAM-based system.
+ * UNIX/PAM-based system.
  *
  * Author: Johannes Findeisen <you@hanez.org> - 2024
- * License: MIT (see LICENSE)
+ * License: Apache-2.0 (see LICENSE)
  */
 
-#include <pwd.h>        // For struct passwd and getpwnam
-#include <security/pam_appl.h>
-#include <security/pam_misc.h>
 #include <stdbool.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <termios.h>    // For terminal input settings
+#include <termios.h>
-#include <unistd.h>     // For getopt and access to user info
+#include <unistd.h>
 
-#define MAX_USERNAME_LEN 32
+#include "checkpw.h"
-#define MAX_PASSWORD_LEN 256
-
-#ifndef MAX_UID
-#define MAX_UID 1000
-#endif
-
-#ifndef MIN_UID
-#define MIN_UID 1000
-#endif
-
-#define VERSION 1_0_3
-
-// Custom data structure to hold user-entered password
-struct pam_credentials
-{
-    const char *password;
-};
-
-// PAM conversation function to supply the password
-int pam_conversation(int num_msg, const struct pam_message **msg,
-                     struct pam_response **resp, void *appdata_ptr)
-{
-    struct pam_response *response = NULL;
-    struct pam_credentials *credentials = (struct pam_credentials *)appdata_ptr;
-    int i;
-
-    response = (struct pam_response *)malloc(sizeof(struct pam_response) * num_msg);
-    if (response == NULL)
-        return PAM_CONV_ERR;
-
-    for (i = 0; i < num_msg; i++) {
-        switch (msg[i]->msg_style) {
-            case PAM_PROMPT_ECHO_ON:
-            case PAM_PROMPT_ECHO_OFF:
-                response[i].resp = strdup(credentials->password);
-                response[i].resp_retcode = 0;
-                break;
-            default:
-                free(response);
-                return PAM_CONV_ERR;
-        }
-    }
-
-    *resp = response;
-    return PAM_SUCCESS;
-}
-
-int authenticate(const char *username, const char *password, int verbose)
-{
-    int retval;
-    pam_handle_t *pamh = NULL;
-    struct pam_credentials credentials = { password };
-    struct pam_conv conv = { pam_conversation, &credentials };
-
-    if (verbose)
-        printf("Starting PAM authentication for user '%s'.\n", username);
-
-    retval = pam_start("login", username, &conv, &pamh);
-
-    if (retval == PAM_SUCCESS) {
-        if (verbose)
-            printf("PAM authentication initialized.\n");
-        retval = pam_authenticate(pamh, 0); // Attempt to authenticate
-    } else {
-        if (verbose)
-            printf("pam_start failed: %s\n", pam_strerror(pamh, retval));
-    }
-
-    if (retval == PAM_SUCCESS) {
-        if (verbose)
-            printf("User '%s' authenticated successfully.\n", username);
-
-        retval = pam_acct_mgmt(pamh, 0); // Check account validity
-        if (retval != PAM_SUCCESS && verbose)
-            printf("pam_acct_mgmt failed: %s\n", pam_strerror(pamh, retval));
-
-    } else {
-        if (verbose)
-            printf("pam_authenticate failed: %s\n", pam_strerror(pamh, retval));
-    }
-
-    if (pam_end(pamh, retval) != PAM_SUCCESS) {
-        pamh = NULL;
-        fprintf(stderr, "Failed to release PAM authenticator\n");
-        exit(1);
-    }
-
-    if (retval != PAM_SUCCESS && verbose) {
-        printf("Authentication failed for user '%s'.\n", username);
-    }
-
-    return (retval == PAM_SUCCESS ? 0 : 1); // 0 for success, 1 for failure
-}
 
 // Function to prompt user for input, optionally hiding input
 void prompt_for_input(char *buffer, size_t size, const char *prompt,
-                      int hide_input)
+                      bool hide_input)
 {
     printf("%s", prompt);
     fflush(stdout);
@@ -159,41 +63,42 @@ void prompt_for_input(char *buffer, size_t size, const char *prompt,
 
 void print_usage(const char *prog_name)
 {
-    fprintf(stderr, "\n");
+    printf("\n");
-    fprintf(stderr, "Usage: %s [-u <username>] [-p <password>] [-i] [-v] [-h]\n", prog_name);
+    printf("Usage: %s [-u <username>] [-p <password>] [-v] [-V] [-h]\n",
-    fprintf(stderr, "\n");
+           prog_name);
-    fprintf(stderr, "Options:\n");
+    printf("\n");
-    fprintf(stderr, "  -u <username>  Specify username.\n");
+    printf("Options:\n");
-    fprintf(stderr, "  -p <password>  Specify password.\n");
+    printf("  -u <username>  Set username (if not set, the program asks for it).\n");
-    fprintf(stderr, "  -i             Enable interactive mode to prompt for missing username/password.\n");
+    printf("  -p <password>  Set password (if not set, the program asks for it).\n");
-    fprintf(stderr, "  -v             Enable verbose mode.\n");
+    printf("  -v             Enable verbose mode.\n");
-    fprintf(stderr, "  -V             Show program version.\n");
+    printf("  -V             Print program version.\n");
-    fprintf(stderr, "  -h             Show this help.\n");
+    printf("  -h             Show this help.\n");
-    fprintf(stderr, "\n");
+    printf("\n");
 }
 
 int main(int argc, char *argv[])
 {
-    bool interactive = false;
     bool verbose = false;
     bool version = false;
-    char username[MAX_USERNAME_LEN] = {0};
     char password[MAX_PASSWORD_LEN] = {0};
+    char username[MAX_USERNAME_LEN] = {0};
     int opt;
 
     // Parse command-line arguments
-    while ((opt = getopt(argc, argv, "u:p:hivV")) != -1) {
+    while ((opt = getopt(argc, argv, "u:p:hvV")) != -1) {
         switch (opt) {
             case 'u':
                 if (strlen(optarg) >= MAX_USERNAME_LEN) {
-                    fprintf(stderr, "Error: Username is too long (maximum %d characters).\n", MAX_USERNAME_LEN);
+                    fprintf(stderr, "Error: Username is too long (maximum %d characters).\n",
+                            MAX_USERNAME_LEN);
                     exit(1);
                 }
                 strncpy(username, optarg, MAX_USERNAME_LEN - 1);
                 break;
             case 'p':
                 if (strlen(optarg) >= MAX_PASSWORD_LEN) {
-                    fprintf(stderr, "Error: Password is too long (maximum %d characters).\n", MAX_PASSWORD_LEN);
+                    fprintf(stderr, "Error: Password is too long (maximum %d characters).\n",
+                            MAX_PASSWORD_LEN);
                     exit(1);
                 }
                 strncpy(password, optarg, MAX_PASSWORD_LEN - 1);
@@ -201,9 +106,6 @@ int main(int argc, char *argv[])
             case 'h':
                 print_usage(argv[0]);
                 exit(0);
-            case 'i':
-                interactive = true;
-                break;
             case 'v':
                 verbose = true;
                 break;
@@ -211,38 +113,27 @@ int main(int argc, char *argv[])
                 version = true;
                 break;
             default:
-                print_usage(argv[0]);
+                break;
-                exit(1);
         }
     }
 
     if (version) {
-        printf("1.0.3\n");
+        printf("%s\n", VERSION);
         exit(0);
     }
 
-    // If interactive mode is enabled, prompt for missing username and/or password
+    if (username[0] == '\0') {
-    if (interactive) {
+        prompt_for_input(username, sizeof(username), "Username: ", false);
-        if (username[0] == '\0') {
+        if (strlen(username) == 0) {
-            prompt_for_input(username, sizeof(username), "Username: ", 0);
+            fprintf(stderr, "Error: Username cannot be empty.\n");
-            if (strlen(username) == 0) {
+            exit(1);
-                fprintf(stderr, "Error: Username cannot be empty.\n");
-                exit(1);
-            }
         }
+    }
 
-        if (password[0] == '\0') {
+    if (password[0] == '\0') {
-            prompt_for_input(password, sizeof(password), "Password: ", 1);
+        prompt_for_input(password, sizeof(password), "Password: ", true);
-            if (strlen(password) == 0) {
+        if (strlen(password) == 0) {
-                fprintf(stderr, "Error: Password cannot be empty.\n");
+            fprintf(stderr, "Error: Password cannot be empty.\n");
-                exit(1);
-            }
-        }
-    } else {
-        // If not in interactive mode, ensure username and password are provided
-        if (username[0] == '\0' || password[0] == '\0') {
-            fprintf(stderr, "Error: Username and password must be provided unless interactive mode is enabled.\n");
-            print_usage(argv[0]);
             exit(1);
         }
     }
@@ -254,17 +145,19 @@ int main(int argc, char *argv[])
         exit(1);
     }
 
-    // Check if the user's UID is below the minimum allowed UID and not higher than maximum allowed UID
+    // Check if the user's UID is below the minimum allowed UID and not higher
+    // than maximum allowed UID
     if (pwd->pw_uid < MIN_UID || pwd->pw_uid > MAX_UID) {
-        fprintf(stderr, "Error: User '%s' has a UID less than %d or higher than %d and is not allowed to authenticate.\n", username, MIN_UID, MAX_UID);
+        fprintf(stderr, "Error: User '%s' has a UID higher than %d or lower than %d and is not allowed to authenticate.\n",
+                username, MAX_UID, MIN_UID);
         exit(1);
     }
 
     if (verbose)
-        printf("User '%s' passed UID check (UID: %d).\n", username, pwd->pw_uid);
+        printf("User '%s' passed UID check (UID: %d).\n", username,
+               pwd->pw_uid);
 
-    // Authenticate the user
+    if (authenticate(username, password, verbose) == true) {
-    if (authenticate(username, password, verbose) == 0) {
         printf("Authenticated successfully.\n");
         return 0;
     } else {

checkpw.h

@@ -0,0 +1,121 @@
+/**
+ * checkpw.h is part of checkpw, a program that checks the validity of a users
+ * password on a UNIX/PAM-based system.
+ *
+ * Author: Johannes Findeisen <you@hanez.org> - 2025
+ * License: Apache-2.0 (see LICENSE)
+ */
+
+#include <pwd.h>
+#include <security/pam_appl.h>
+#include <security/pam_misc.h>
+
+#define VERSION "1.1.0"
+
+#ifndef MAX_PASSWORD_LEN
+#define MAX_PASSWORD_LEN 256
+#endif
+
+#ifndef MAX_USERNAME_LEN
+#define MAX_USERNAME_LEN 32
+#endif
+
+#ifndef MAX_UID
+#define MAX_UID 1000
+#endif
+
+#ifndef MIN_UID
+#define MIN_UID 1000
+#endif
+
+bool authenticate(const char *username, const char *password, bool verbose);
+
+int pam_conversation(int num_msg, const struct pam_message **msg,
+                     struct pam_response **resp, void *appdata_ptr);
+
+struct pam_credentials
+{
+    const char *password;
+};
+
+bool authenticate(const char *username, const char *password, bool verbose)
+{
+    int retval;
+    pam_handle_t *pamh = NULL;
+    struct pam_credentials credentials = { password };
+    struct pam_conv conv = { pam_conversation, &credentials };
+
+    if (verbose)
+        printf("Starting PAM authentication for user '%s'.\n", username);
+
+    retval = pam_start("login", username, &conv, &pamh);
+
+    if (retval == PAM_SUCCESS) {
+        if (verbose)
+            printf("PAM authentication initialized.\n");
+        retval = pam_authenticate(pamh, 0); // Attempt to authenticate
+    } else {
+        if (verbose)
+            fprintf(stderr, "Error: pam_start failed: %s\n", pam_strerror(pamh,
+                    retval));
+    }
+
+    if (retval == PAM_SUCCESS) {
+        if (verbose)
+            printf("User '%s' authenticated successfully.\n", username);
+
+        retval = pam_acct_mgmt(pamh, 0); // Check account validity
+        if (retval != PAM_SUCCESS && verbose)
+            fprintf(stderr, "Error: pam_acct_mgmt failed: %s\n",
+                    pam_strerror(pamh, retval));
+    } else {
+        if (verbose)
+            fprintf(stderr, "Error: pam_authenticate failed: %s\n",
+                    pam_strerror(pamh, retval));
+    }
+
+    if (pam_end(pamh, retval) != PAM_SUCCESS) {
+        pamh = NULL;
+        fprintf(stderr, "Error: Failed to release PAM authenticator.\n");
+        exit(1);
+    }
+
+    if (retval != PAM_SUCCESS && verbose) {
+        fprintf(stderr, "Error: Authentication failed for user '%s'.\n",
+                username);
+    }
+
+    return (retval == PAM_SUCCESS ? true : false);
+}
+
+// PAM conversation function to supply the password
+int pam_conversation(int num_msg, const struct pam_message **msg,
+                     struct pam_response **resp, void *appdata_ptr)
+{
+    struct pam_response *response = NULL;
+    struct pam_credentials *credentials = (struct pam_credentials *)appdata_ptr;
+    int i;
+
+    response = (struct pam_response *)malloc(sizeof(struct pam_response)
+                * num_msg);
+
+    if (response == NULL)
+        return PAM_CONV_ERR;
+
+    for (i = 0; i < num_msg; i++) {
+        switch (msg[i]->msg_style) {
+            case PAM_PROMPT_ECHO_ON:
+            case PAM_PROMPT_ECHO_OFF:
+                response[i].resp = strdup(credentials->password);
+                response[i].resp_retcode = 0;
+                break;
+            default:
+                free(response);
+                return PAM_CONV_ERR;
+        }
+    }
+
+    *resp = response;
+    return PAM_SUCCESS;
+}
+