nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Expect / Perl / 552 / 65

Adam Stoller

I'm curious whether anyone else has a customization like this and if so whether they've run into a similar problem, and if so [horrible sentence ;-] how they overcame it.

Original System: TS 5.5.2 / Solaris 8 / Expect v. 5.37.2
New System: TS 6.5.0 / Solaris 9 / Expect v. 5.39.0 (and now back to 5.37.2)

We have a custom menu item for allowing users to change their password on the TS server.

The original code had a CGI script that prompted for the existing password [P1], the new password [P2], and a confirmation of the new password [P3] and then on-submit of the form, exec'd an Expect script which did some preliminary testing of the values provided (e.g., all parameters have values, P2 == P3, length(P2) > 5, etc.), and then it:
- Spawns /usr/bin/passwd
-- waits for "Enter existing login password: "
- sends P1
-- waits for either:
--+ "New Password: ", or
--+ "passwd: Sorry, wrong passwd"

If we got the latter - we bomb out. If we got the former ...
- we continue by sending P2 and looking for:
-- "Re-enter new Password: "
-- "one numeric or special character."
-- "must be at least 6 characters"
-- "differ by at least 3 positions"

Unless we get the first one, we abort. If we get the first one, we send P3 and verify that we get:
- "passwd: password successfully changed for"
back from the system - and then everyone is happy - yippie, yahooie, etc.

On the old system - this seemed to work fine.
On the new system, originally with a newer version of expect - it seemed to work for changing some passwords, but if your original password contained an '@' it failed; saying "passwd: Sorry, wrong passwd"

So I started looking at Expect.pm -- a perl module for working with Expect -- and I put together a fairly nice script for doing all this and ran it from the command line and it worked just fine.

I plugged the same code into the CGI code for the custom menu item - and now it doesn't matter *what* password you use for P1 - it fails when running from a custom menu item with "passwd: Sorry, wrong passwd" - but works just fine when run from the command line.

I've turned on debugging and as near as I can tell it doesn't matter which way I run it - the same text is getting sent to the spawned /usr/bin/passwd process - but it doesn't work when coming from a CGI while it does work when coming from the command line.

If anyone has some ideas - I'm interested in hearing them.

--fish
Senior Consultant, Quotient Inc.
http://www.quotient-inc.com

Find more posts tagged with

Comments

Valentine

May be you have to escape/unescape the parameters [p1-p3]?

Are there any errors in the error_log (/var/adm/iwui)?

skip11

Hi,

We use Expect to do something similar. On a Soalris 7 system we had it working, then one day an engineer patched
it with the latest Recommended and Security patches and it broke our cgi. The passwd prompts changed, that's all.

Here is a snipett of the working code on Solaris 8:

sub set_passwd ($$$)
{
use Expect;

$Expect::Log_Stdout = 0;

my($user,$old,$new) = @_;

my $TIMEOUT = 2;
my $PASSWD = "/bin/passwd";
my $SU = '/bin/su';
my $command = "$SU $user -c \"$PASSWD $user\"";

# spawn the su command using expect
my $passwd = Expect->spawn($command) || return (undef,"Couldn't open $PASSWD");

# wait for su to prompt for password
my $rv = $passwd->expect($TIMEOUT,
"Password:",
"su: Unknown id:");
$rv == 2 && return (undef,"User $user unknown.");
$rv || return (undef,"Didn't get su password prompt.");

# send the password for the user
print $passwd "$old\r";

# wait for passwd to prompt for old password
$rv = $passwd->expect($TIMEOUT,
"Enter existing login password:",
"su: Sorry");
$rv == 2 && return (undef,"Login password is incorrect.");
$rv || return (undef,"Didn't get prompt for old password.");

# print old password
print $passwd "$old\r";
$rv = $passwd->expect($TIMEOUT,
"New Password:",
"Permission denied");
$rv == 2 && return (undef,"Old password is incorrect.");
$rv || return (undef,"Timed out without seeing prompt for new password.");

# print new password
print $passwd "$new\r";
$rv = $passwd->expect($TIMEOUT,
"Re-enter new Password:",
"Password too short",
"Passwords must differ by at least 3 positions",
"must contain at least two alphabetic characters");
#$rv == 2 && return (undef,"Please use a longer password (at least 6 characters).");
$rv == 2 && return (undef,"Password too short - must be at least 6 characters.");
#$rv == 3 && return (undef,"Passwords must differ by at least 3 positions.");
$rv == 3 && return (undef,"Old and new passwords must differ by at least 3 positions.");
$rv == 4 && return (undef,"The first 6 characters of the password must contain at least two alphabetic characters and at least one numeric or special character.");
$rv || return (undef,"Server did not accept the new password.");

# reconfirm password
print $passwd "$new\r";
$rv = $passwd->expect($TIMEOUT,
"They don't match; Please try again.");
$rv == 1 && return (undef,"Second password doesn't match.");

$passwd->hard_close();

return (1,"password successfully changed for $user.");
}

R.Barger
Credit Suisse Group
Zurich, Switzerland

Adam Stoller

Hmm - the prompts you're seeing on Solaris 8 look different then what I believe we were seeing on Solaris 8 and definitely different than what we're seeing on Solaris 9. Our code looks something like this:...
use Expect;
...
sub secondPass{
my $exp = new Expect();
$exp->log_user(0);

...
eval(LaunchPasswd($exp);
if ($@) {
...
}
...
}
#======================================================================
# Data Sending Routines
#======================================================================

# Spawns the passwd program
sub LaunchPasswd{
my $exp = shift;
$exp->spawn("/usr/bin/passwd") || die "Cannot spawn /usr/bin/passwd ($!)";
$exp->expect(10, ["Enter existing login password: ", \&send_old_pw]);
$exp->expect(10,
["New Password: ", \&send_new_pw],
["passwd: Sorry, wrong passwd", \&wrong_pw],
);
}

# Send the original password
sub send_old_pw{
my $exp = shift;
$exp->send("$cgi->{form}{old}\n");
}

# Send the new password
sub send_new_pw{
my $exp = shift;
$exp->send("$cgi->{form}{new1}\n");
$exp->expect(10,
["Re-enter new Password: ", \&send_new_pw2],
["one numeric or special character.", \&spec_char],
["must be at least 6 characters", \&too_short],
["differ by at least 3 positions", \&differ],
);
}
# Send the confirmation of the new password
sub send_new_pw2{
my $exp = shift;
$exp->send("$cgi->{form}{new2}\n");
$exp->expect(10,
[qr/passwd: password successfully changed for/, \&success],
['timeout', \&timeout],
['eof', \&end_of_input]);
}

# intentional no-op
sub success{}

#======================================================================
# Error Output Routines
#======================================================================

sub timeout{
print qq[<h3 align="center">Session timed out</h3>\n];
PrintFooter(1);
}
sub end_of_input{
print qq[<h3 align="center">End of input reached</h3>\n];
PrintFooter(1);
}
# Error regarding original password
sub wrong_pw{
print qq[<h3 align="center">Your password is incorrect.</h3>\n];
PrintFooter(1);
}

# Error regarding characters in new password
sub spec_char{
print join(" ",
qq[<h3 align="center">The first 6 characters of the password],
qq[must contain at least two alphabetic characters and at],
qq[least one numeric or special character.</h3>\n]);
PrintFooter(1);
}

# Error regarding length of new password
sub too_short{
print join(" ",
qq[<h3 align="center">Your password is too short - must be],
qq[at least 6 characters.</h3>\n]);
PrintFooter(1);
}

# Error regarding difference between old and new passwords
sub differ{
print join(" ",
qq[<h3 align="center">Your old and new passwords must differ],
qq[by at least 3 positions</h3>\n]);
PrintFooter(1);
}

--fish
Senior Consultant, Quotient Inc.
http://www.quotient-inc.com

Adam Stoller

I don't think anything needs to be escaped / unescaped - unless there's something specific to being sent from a CGI rather than a CLT that would affect this.

--fish
Senior Consultant, Quotient Inc.
http://www.quotient-inc.com

skip11

Hi,

The system patch level on Solaris 8 which changed the prompts is SunOS 5.8 Generic_108528-29 sun4u sparc SUNW,Ultra-4 Solaris.
What is the minor patch number you are running ? If you are running a lower rev of the minor patch number, that would explain the
difference, and I would not be surprised if the passwd prompts are also different in Solaris 9.

R.Barger
Credit Suisse Group
Zurich, Switzerland

Adam Stoller

But the thing is - regardless of the prompts - for some reason the code I posted works fine when run from a CLT, but ends up getting the "wrong password" prompt when entering the original password [p1] when run from a CGI.

That's what I can't understand - why does it behave differently when run from a CGI -- even though with debugging enabled it seems to show that it's sending the *exact* *same* *string* in both cases?

--fish
Senior Consultant, Quotient Inc.
http://www.quotient-inc.com

skip11

Hi,

Do you think you may not be waiting long enough for the cgi to bring up the passwd prompt ? If you
passed the existing login passwd to the cgi before the the prompt was ready, then the prompt would get
only part of the password. I've seen this while running passwd or logging into a system with a load - I'm
keying the password before the prompt is presented.

We have a this:

my $TIMEOUT = 2;
my $PASSWD = "/bin/passwd";
my $SU = '/bin/su';
my $command = "$SU $user -c \"$PASSWD $user\"";

# spawn the su command using expect
my $passwd = Expect->spawn($command) || return (undef,"Couldn't open $PASSWD");

# wait for su to prompt for password
my $rv = $passwd->expect($TIMEOUT,
"Password:",
"su: Unknown id:");

Maybe you already do this, but I'm fishing here as I cannot understand why a CLT works but not the GUI.

R.Barger
Credit Suisse Group
Zurich, Switzerland

Adam Stoller

Well, we're using a timeout of 10 (not 2) and we're running the CGI through the iw_cgi_wrapper.cgi - which should obviate the need for doing the 'su' part that you have - so unless 10 seconds is insufficient time -- and besides we wait until we see the expected prompt before we send the password string -- I think we're still missing some tiny [but significant] distinction between running it as a CLT and running it as a CGI.

--fish
Senior Consultant, Quotient Inc.
http://www.quotient-inc.com

shanon

fish,

i've never used expect, but i'm just trying to think of differences between the cmd line and the CGI... i know it's been said, but maybe you have to escape all the relative perl symbols:

$str =~ s/\@/\\\@/g;
$str =~ s/\$/\\\$/g;
$str =~ s/\&/\\\&/g;

etc, etc. the only reason i say this is because i had a similar problem with another module and task and i just tried that on a whim and it worked...

Shanon Levenherz
Mercer eBusiness Team
shanon.levenherz@mercer.com
http://www.mercerhr.com

Adam Stoller

Well - if/when I can back onto that server I'll try to find some time to try this out (right now, this custom menu item is on the back-burner)
Thanks.

--fish
Senior Consultant, Quotient Inc.
http://www.quotient-inc.com