You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by sf...@apache.org on 2009/10/23 20:13:48 UTC
svn commit: r829162 - /httpd/httpd/trunk/support/htpasswd.c
Author: sf
Date: Fri Oct 23 18:13:46 2009
New Revision: 829162
URL: http://svn.apache.org/viewvc?rev=829162&view=rev
Log:
Print a warning if a password is truncated by crypt.
Modified:
httpd/httpd/trunk/support/htpasswd.c
Modified: httpd/httpd/trunk/support/htpasswd.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/support/htpasswd.c?rev=829162&r1=829161&r2=829162&view=diff
==============================================================================
--- httpd/httpd/trunk/support/htpasswd.c (original)
+++ httpd/httpd/trunk/support/htpasswd.c Fri Oct 23 18:13:46 2009
@@ -186,6 +186,10 @@
pw = pwin;
memset(pwv, '\0', sizeof(pwin));
}
+ if (alg == ALG_CRYPT && strlen(pw) > 8) {
+ apr_file_printf(errfile, "Warning: Password truncated to 8 characters "
+ "by CRYPT algorithm." NL);
+ }
switch (alg) {
case ALG_APSHA:
Re: svn commit: r829162 - /httpd/httpd/trunk/support/htpasswd.c
Posted by Stefan Fritsch <sf...@sfritsch.de>.
On Friday 23 October 2009, William A. Rowe, Jr. wrote:
> Isn't this platform specific? Seems wrong. Why not test the pw
> and the pw+1 char to determine if this is, in fact, true.
Our documentation doesn't talk about the limit being platform
specific. But to be save, I have changed it in r829355.
> With all our integration into openssl maybe we should add 3des
> strong crypt for all platforms that don't otherwise offer it? So
> much easier now that the rules about crypto munitions in open
> source have been relaxed.
The apr1 md5 algorithm seems secure enough. I don't think there is
need for another proprietary password hash algorithm. But it may be
nice to add support for whatever is used by linux/*BSD/solaris
nowadays. bcrypt/crypt_blowfish [1] (included in recent *BSD and
others) would be especially interesting in that it allows to adjust
the processing cost for a password check while staying backward
compatible.
[1] http://www.openwall.com/crypt/
Re: svn commit: r829162 - /httpd/httpd/trunk/support/htpasswd.c
Posted by "William A. Rowe, Jr." <wr...@rowe-clan.net>.
sf@apache.org wrote:
> Author: sf
> Date: Fri Oct 23 18:13:46 2009
> New Revision: 829162
>
> URL: http://svn.apache.org/viewvc?rev=829162&view=rev
> Log:
> Print a warning if a password is truncated by crypt.
>
> Modified:
> httpd/httpd/trunk/support/htpasswd.c
>
> Modified: httpd/httpd/trunk/support/htpasswd.c
> URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/support/htpasswd.c?rev=829162&r1=829161&r2=829162&view=diff
> ==============================================================================
> --- httpd/httpd/trunk/support/htpasswd.c (original)
> +++ httpd/httpd/trunk/support/htpasswd.c Fri Oct 23 18:13:46 2009
> @@ -186,6 +186,10 @@
> pw = pwin;
> memset(pwv, '\0', sizeof(pwin));
> }
> + if (alg == ALG_CRYPT && strlen(pw) > 8) {
> + apr_file_printf(errfile, "Warning: Password truncated to 8 characters "
> + "by CRYPT algorithm." NL);
> + }
Isn't this platform specific? Seems wrong. Why not test the pw and the pw+1 char
to determine if this is, in fact, true.
With all our integration into openssl maybe we should add 3des strong crypt for
all platforms that don't otherwise offer it? So much easier now that the rules
about crypto munitions in open source have been relaxed.