This script is made to run on DD-WRT as I am running an OpenVPN server on it just to securely connect to my home network when I'm on the go. Basically, the input ($1
) that goes into this script is a .tmp file generated by OpenVPN when some user wishes to log into the server. The .tmp file consists of 2 lines where the 1st line is the username and the 2nd line is the password.
In this day and age, I'm afraid that potential hackers could inject unintended malicious arguments into the username or password which could exploit my script with the intention to take control over the DD-WRT router (in a way similar to SQL-Injection). So far I have made some huge improvements to the script but I'm not sure if I am finished yet.
#!/bin/sh
#This script was made with OpenVPN via-file in mind
#Location of the Approved Username/Password File
USERS="/somefolder/users"
#Check to see if username and password in the OpenVPN file has any special characters line by line
#Terminate script if special characters are used
while IFS= read -r line
do
case "$line" in *[!-_a-zA-Z0-9]*) exit 1 ;; esac
done < "$1"
Username=`awk 'NR==1' "$1"`
Password=`awk 'NR==2' "$1"`
HASHPASS=`echo -n "$Username$Password" | md5sum | sed s'/\ -//'`
i=0
while [ $i -lt 10 ]; do
HASHPASS=`echo -n $HASHPASS$HASHPASS | md5sum | sed s'/\ -//'`
i=`expr $i + 1`
done
if grep -q "$Username:$HASHPASS" $USERS; then
echo "User Authenticated."
exit 0
fi
echo "Login credentials failed."
exit 1
#!/bin/sh
- do you intend this to be POSIX-compliant shell? \$\endgroup\$