Checking password strength with CrackLib

Password complexity is a fine balance between memorable passwords and crack-able passwords. But how you measure that? For instance “john192″ is much easier to crack than “9john2″. However password strength tests approach both with the same algorithm. Even company policies are being made up requiring passwords to cary certain amount of digits or symbols.

A fine line is drawn by a CrackLib – a library coming a long way from Unix and designed for a single purposes of assessing password strength. This article is about how to integrate CrackLib into password verification field.

You can see demo: http://agiletech.ie/pwcheck/

Preparing the back-end

Probably all Linux-es come with cracklib. Look for a /usr/sbin/cracklib-check, you will need it to perform a check. This executable takes passwords on the stdin and output either OK or error message on the stdout. We are going to use System/ProcessIO class from ATK to interact with it:

 $cl=$this->add('System_ProcessIO')
                ->exec('/usr/sbin/cracklib-check')
                ->write_all($pas)
                ;
            $out=trim($cl->read_all());

Next, we will need to create a form with a password field:

        $f=$this->add('Form',null,'Form');
        $f->js(true)->_load('ui.atk4.form')->atk4_form();
        $p=$f->addField('password','password','Password')
            ->setProperty('size',60)
            ->setProperty('autocomplete','off');

Now, the easiest would be is if we submitted a form every time user types something, however you can also use “ajaxec”. (If you want me to explain how to use that – please let me know in the comments section)

        $p->js(true)->univ()->autoChange(100);
        $p->js('change',$f->js()->submit());
        $p->template->set('after_field','<br/><span id="'.$p->name.'_strength">&nbsp;<span>');
        $p->js(true)->focus()

This will make field submit the form every-time you type something. AutoChange will call onchange handler 0.1 second after user stops typing. Then you need a place where to output and we’re using “after_field” tag in field’s template to insert a placeholder. Finally when your form is being submitted, you execute that code above along with javascript action:

        if($f->isSubmitted()){
            $pas=$f->get('password');

            $cl=$this->add('System_ProcessIO')
                ->exec('/usr/sbin/cracklib-check')
                ->write_all($pas)
                ;
            $out=trim($cl->read_all());
            $out=str_replace($pas,'',$out);
            $out=preg_replace('/^:\s*/','',$out);
            $p->js()->_selector('#'.$p->name.'_strength')->text($out)->css(array('color'=>$out=="OK"?'black':'red'))->execute();
        }

We even take care of the message color. Probably my designer would be happier if i change the class here, he would be able to prepend message with an image.

There you have it. I also changed the template of the page to contain light-weight CMS before and after the form.

http://www.agiletech.ie/pwcheck/

About these ads