Name
libaccdb - The Unified Account Database libaccdb API
libaccdb provides some essential functions for applications wishing to access a user database. It also contains some common used code, such as password generation routines. Applications that wish to use ACCDB must link against it, usually with gcc's -laccdb parameter.
accdb_load() opens a back-end module (module.so and/or module.dll), acquires all necessary symbols and returns them in a malloc()ed struct accdb_module, which is then to be freed with accdb_unload(). In most cases, module will be just be a zero-terminated string with an asterisk, which says to use the default ACCDB back-end, defined in ./vetc/libaccdb/accdb or /etc/libaccdb/accdb, variable DEFAULT_BACKEND. Since Vitalnix v1.0.28.0, a sub-module can be specified by adding a colon and the name (i.e. "perl:shadow.pl"). On failure, accdb_load() returns NULL and sets errno to the ones set by system calls, plus EFAULT if no q_open() function in the ACCDB module could be found. ENOENT is returned if no default module was defined.
The back-end interface is discussed in its own chapter. Configuration file parsing
While developing the Vitalnix Suite, I came to a point where I realized I had common used code duplicated in nearly every file that used ACCDB in some way, so I decided to move that code part to ACCDB since it is a central place. Configuration files are based on the key=value scheme, and lines beginning with a hash mark (#) are ignored, as are empty lines and unrecognized keys:
ACCDB provides two (one) function to deal with configuration files. The second is just for handling multiple configuration files at once.
accdb_rconfig() will return >0 to indicate success, or <0 (= errno) to signal an error. accdb_rconfig_pv() will return the number of files successfully parsed. Types for rconfig_opt.type can be:
.callback is called when the corresponding option has been parsed and .callback is not NULL. Since the options can be arranged in any order in the configuration file, you should take care when assuming that other keys/ptrs have already been filled. uptr can be an argument of your choice, i.e.:
To start parsing a file, call the accdb_rconfig() function with the corresponding parameters. If you want to read configuration files from different paths, i.e. to build up on default values, you can use accdb_rconfig_pv() like the next code example. (pv = path vector)
The call to accdb_rconfig() will either return 1 for success, 0 for no success (actually 0 is never returned) and -errno for an error. The next call, with pv_a will parse /etc/configfile, etc. (pv from left to right). No value is returned. The call with pv_b will only read the first successful opened file, i.e. if you have both ./configfile and /etc/configfile, only the former is read if it can be opened. Password generation
accdb_genpw() generates a random password. It is configured to use libHX's independent random generator layer, to use /dev/urandom where possible (otherwise uses libc's rand()). The new password of length len is put into plain. A trailing '\0' character is appended, so plain must be 1 bigger than the value of len. If salt is NULL, a new salt will be generated. The salt parameter is usually only used for password authentication. flags is a bitmask, which may consists of these options: GENPW_PHONEMIC uses a different algorithm, to choose passwords which can be spoken and (may be | is) easy to remember. GENPW_ONE_CASE specifies that there should be at least one upper-case character in the plain password; GENPW_ONE_DIGIT is the same for a digit, respectively. accdb_cryptpw() takes a plain text key -- mostly this a plaintext password -- and encrypts it, being usable for /etc/shadow or similar. Space for the resulting crypted string is allocated within accdb_cryptpw(), and is put into *crypted. Be sure to free() it when you are done with it. meth specifies the encryption to use. Valid values are CRYPW_DES, CRYPW_MD5 and CRYPW_BLOWFISH. Blowfish is the preferred algorithm nowadays which provides maximum security of these three.
DES and MD5 crypt is only available if your libc has them. Blowfish encryption routines are always available since I have included them in Vitalnix.
|