From mboxrd@z Thu Jan 1 00:00:00 1970 From: IT Superhack To: development@lists.ipfire.org Subject: Question concerning commit #eef9b2529c3cab522dac4f4bcfa1a0075376514e Date: Wed, 05 Oct 2016 08:13:00 +0000 Message-ID: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============6747790646752221391==" List-Id: --===============6747790646752221391== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hello Michael, hello List, I have a question concerning the commit #eef9b2529c3cab522dac4f4bcfa1a0075376= 514e (http://git.ipfire.org/?p=3Dipfire-2.x.git;a=3Dcommit;h=3Deef9b2529c3cab522da= c4f4bcfa1a0075376514e). It is correct that htpasswd uses the MD5 algorithm as default, which is not very secure indeed. However, the -s option (which enforces the use of SHA) is insecure since there is no salt. In case IPFire uses the same htpasswd version I use, I'd suggest the use of bcrypt (option: -B), since it is stronger than both SHA and MD5. This issue also appears in the help output of htpasswd: twilson(a)fra-03-47-1b:~> htpasswd --help [...] -m Force MD5 encryption of the password (default). -B Force bcrypt encryption of the password (very secure). -C Set the computing time used for the bcrypt algorithm (higher is more secure but slower, default: 5, valid: 4 to 31). -d Force CRYPT encryption of the password (8 chars max, insecure). -s Force SHA encryption of the password (insecure). -p Do not encrypt the password (plaintext, insecure). [...] On other systems than Windows and NetWare the '-p' flag will probably not wor= k. The SHA algorithm does not use a salt and is less secure than the MD5 algorit= hm. twilson(a)fra-03-47-1b:~> If your htpasswd version is somehow patched against this problem, just ignore my e-mail. :-) Best regards, Timmothy Wilson --===============6747790646752221391== Content-Type: application/pgp-signature Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="signature.asc" MIME-Version: 1.0 LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0KCmlRRWNCQUVCQ2dBR0JRSlg5TFk2QUFvSkVP eUxhMUM1RWF6clRHMElBSWtEOFN5b3ltMmZ6djBLeWwxYU9NM0YKNXlTdCtvRS8xUzE2VjN4OXow bGQwQ2Q3UWczNjI5VHM3Wm1XZWNkLzMzVkVOWDNsSk9TU0UwcnpvcHJyZjZmMApFTGU5Ym9LZW1a WjM1Q2FpRS9yV0xpLzg5Nit1TEx6S1QzR2pIK201VFFqRG9XVkRGNjdNVHkxM3VRci9IcEpPCldD WGZ4bTF3QTl4N2VnRnRIWHFQVCtvanpjc2Q5WlJQa01qblU1TnJpSGdTUU01OUpBNEp3bnlydDFT RVVveVkKZUZ3WXRob20xRno0ZmtZbHRkSTRxZW92alRURkJOeVhLMXhUUk9BVm0zdStrQ09DaFly MklSUXZOR3RXejZodwpPaDNtQnZDMmJFWUIzQlB6V0tBdW91SDYzcC91RHhibUo0S1ZmeWZmL3lk bEk2aUpQK254Q3pNZHFublpVdWc9Cj02ZHVhCi0tLS0tRU5EIFBHUCBTSUdOQVRVUkUtLS0tLQo= --===============6747790646752221391==--