Dictionary brute force on DES encrypted passwords
You're keeping us in suspense — I'm dying to know which password matched!

Many password crackers also test for common character substitutions, e.g. o → 0, i → 1, s → $.

Other than that, the general technique seems sound.

I do have a few general remarks, though.


What is #define _XOPEN_SOURCE for?  Sometimes, defining it will change some of the functions you call.  However, it would only have any effect if you put it before your #includes.
It would be good to make a function, even for a simple program like this.  I suggest that main() be responsible for parsing and validating the command line and opening the word list, calling crack(const char *pwhash, FILE *wordlist) to do the actual work.
You don't close the word list if you find a match.
Consider returning a non-zero exit status if the password is not found.  That makes your program more useful to scripts.