Project

General

Profile

Actions
Copy link

Bug #2483

closed

problems with htpasswd crypt(3) support [patch]

Added by sthen_ almost 11 years ago. Updated almost 11 years ago.

Status:
Fixed
Priority:
Normal
Category:
-
Target version:
-
ASK QUESTIONS IN Forums:

Description

I've been trying to use bcrypt with lighttpd's htpasswd support in mod_auth. Current versions of these look like this:

$2a$09$mnKs1iO4h3egPBIROOwvh.Xax70l3rFhvr4evXxJRFQMUziX/A82i

2a is the variant version; other ones currently used are 2x and 2y. 2 is long defunct.

09 is the log of the number of rounds.

The password AND salt are included in the final characters.

To compare a password you pass the entire hashed string to crypt() along with the user-supplied password, then compare the returned value against the stored value in the htpasswd file. This same method also works, at least in glibc and OpenBSD, for MD5 and for old-style crypted passwords; there is no need to split off the salt.

Diff attached.

Files

crypt.diff (1.25 KB) crypt.diff sthen_, 2013-04-24 22:52
Actions
Copy link
 #1

Updated by sthen_ almost 11 years ago

"The password AND salt are included in the final characters." -- I meant, "included in the final argument".

Actions
Copy link
 #2

Updated by stbuehler almost 11 years ago

  • Status changed from New to Fixed
  • % Done changed from 0 to 100

Applied in changeset r2869.

Actions
Copy link

Also available in: Atom