Hi kids,
Following from Tom Donovan's work on
http://wiki.apache.org/httpd/EncryptedPasswords I thought I'd have a
pop at converting it to xdocs. The result is attached.
It builds ok, and the result isn't too shaby, but ./build.sh
validate-xml fails with:
validate-xml:
[xmlvalidate]
/Users/noodl/Apache/httpd-trunk/docs/manual/misc/password_encryptions.xml:158:15:
The content of element type "section" must match
"(title,related?,(section|p|example|note|table|ul|ol|dl|pre|blockquote)*)".
[xmlvalidate]
/Users/noodl/Apache/httpd-trunk/docs/manual/misc/password_encryptions.xml
is not a valid XML document
[xmlvalidate] 456 file(s) have been successfully validated.
I'm having trouble see where I went wrong, as the first section
contains only title, section, p, and dl elements. What did I mess up?
Also, as this is my first go at producing a whole document, please
don't be shy telling me what I've messed up. In particular I think I
may have used too many nested section elements.
In my trunk working copy, this file is docs/manual/misc/password_encryptions.xml
Is that name ok? There's a few different combinations of
squishedworks, under_scored_names and hyphenated-gubbins in that
directory.
--
noodl
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE manualpage SYSTEM "../style/manualpage.dtd">
<?xml-stylesheet type="text/xsl" href="../style/manual.en.xsl"?>
<!-- $LastChangedRevision: $ -->
<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<!-- Original wiki page by Tom Donovan, translated to xdocs by noodl -->
<manualpage metafile="password_encryptions.xml.meta">
<parentdocument href="./">Miscellaneous Documentation</parentdocument>
<title>Password Formats</title>
<summary>
<p>Notes about the password encryption formats generated and understood by
Apache.</p>
</summary>
<section id="basic"><title>Basic Authentication</title>
<p>There are four formats that Apache recognizes for basic-authentication
passwords. Note that not all formats work on every platform:</p>
<dl>
<dt>PLAIN TEXT (i.e. <em>unencrypted</em>)</dt>
<dd>Windows, BEOS, & Netware only.</dd>
<dt>CRYPT</dt>
<dd>Unix only. Calls the Unix crypt(3) function with a randomly-generated
32-bit salt and the password.</dd>
<dt>SHA1</dt>
<dd>"{SHA}" + Base64-encoded SHA-1 digest of the password.</dd>
<dt>MD5</dt>
<dd>"$apr1$" + the result of an Apache-specific algorithm using an
iterated (1,000 times) MD5 digest of various combinations of a
randomly-generated 32-bit salt and the password. See the APR source file
<a href="http://svn.apache.org/viewvc/apr/apr-util/trunk/crypto/apr_md5.c?view=markup";>apr_md5.c</a>
for the details of the algorithm.</dd>
</dl>
<section><title>Generating values with htpasswd</title>
<example><title>MD5</title>
$ htpasswd -nbm myName myPassword<br />
myName:$apr1$r31.....$HqJZimcKQFAMYayBlzkrA/
</example>
<example><title>SHA1</title>
$ htpasswd -nbs myName myPassword<br />
myName:{SHA}VBPuJHI7uixaa6LQGWx4s+5GKNE=
</example>
<example><title>CRYPT</title>
$ htpasswd -nbd myName myPassword<br />
myName:rqXexS6ZhobKA
</example>
</section>
<section>
<title>Generating CRYPT and MD5 values with the OpenSSL
command-line program</title>
<p>OpenSSL knows the Apache-specific MD5 algorithm.</p>
<example><title>MD5</title>
$ openssl passwd -apr1 myPassword<br />
$apr1$qHDFfhPC$nITSVHgYbDAK1Y0acGRnY0
</example>
<example><title>CRYPT</title>
openssl passwd -crypt myPassword<br />
qQ5vTYO3c8dsU
</example>
</section>
<section>
<title>Validating CRYPT or MD5 passwords with the OpenSSL command
line program</title>
<p>The salt for a CRYPT password is the first two characters (as a
Base64-encoded binary value). To validate <code>myPassword</code> against
<code>rqXexS6ZhobKA</code></p>
<example><title>CRYPT</title>
$ openssl passwd -crypt -salt rq myPassword<br />
Warning: truncating password to 8 characters<br />
rqXexS6ZhobKA
</example>
<p>Note that using <code>myPasswo</code> instead of
<code>myPassword</code> will produce the same result because only the
first 8 characters of CRYPT passwords are considered.</p>
<p>The salt for an MD5 password is between <code>$apr1$</code> and the
following <code>$</code> (as a Base64-encoded binary value - max 8 chars)
To validate <code>myPassword</code> against
<code>$apr1$r31.....$HqJZimcKQFAMYayBlzkrA/</code></p>
<example><title>MD5</title>
$ openssl passwd -apr1 -salt r31..... myPassword<br />
$apr1$r31.....$HqJZimcKQFAMYayBlzkrA/
</example>
</section>
<section><title>Database password fields for mod_dbd</title>
<p>The SHA1 variant is probably the most useful format for DBD
authentication. Since the SHA1-hash and Base64-encoding functions are
commonly available, other software can populate a database with encrypted
passwords which are usable by Apache basic authentication.</p>
<p>To create Apache SHA1-variant basic-authentication passwords in various
languages:</p>
<example><title>PHP</title>
'{SHA}' . base64_encode(sha1($password, TRUE))
</example>
<example><title>Java</title>
"{SHA}" + new sun.misc.BASE64Encoder().encode(java.security.MessageDigest.getInstance("SHA1").digest(password.getBytes()))
</example>
<example><title>ColdFusion</title>
"{SHA}" & ToBase64(BinaryDecode(Hash(password, "SHA1"), "Hex"))
</example>
<example><title>Ruby</title>
require 'digest/sha1'<br />
require 'base64'<br />
'{SHA}' + Base64.encode64(Digest::SHA1.digest(password))
</example>
<p>C or C++</p>
Use the APR function: <a href="http://apr.apache.org/docs/apr-util/1.2/apr__sha1_8h.html#38a5ac487992a24e941b7501273829e8";>apr_sha1_base64</a>
<example>
<title>PostgreSQL (with the contrib/pgcrypto functions
installed)</title>
'{SHA}'||encode(digest(password,'sha1'),'base64')
</example>
</section>
</section>
<section><title>Digest Authentication</title>
<p>There is only one format which Apache recognizes for
digest-authentication passwords. This format is the MD5 hash of the string
<code>user:realm:password</code> as a 32-character string of hexadecimal
digits. <code>realm</code> is the Authorization Realm argument to the
<directive module="mod_authn_core">AuthName</directive> directive in
httpd.conf.</p>
<section><title>Database password fields for mod_dbd</title>
<p>Since the MD5-hash function is commonly available, other software can
populate a database with encrypted passwords which are usable by Apache
digest authentication.</p>
<p>To create Apache digest-authentication passwords in various
languages:</p>
<example><title>PHP</title>
md5($user . ':' . $realm . ':' .$password)
</example>
<example><title>Java</title>
byte b[] = java.security.MessageDigest.getInstance("MD5").digest( (user + ":" + realm + ":" + password ).getBytes());<br />
java.math.BigInteger bi = new java.math.BigInteger(b);<br />
String s = bi.toString(16);<br />
if (s.length() % 2 != 0)<br />
<indent>
s = "0" + s;
</indent>
// String s is the digest hash
</example>
<example><title>ColdFusion</title>
LCase(Hash( (user & ":" & realm & ":" & password) , "MD5"))
</example>
<example><title>Ruby</title>
require 'digest/md5'<br />
Digest::MD5.hexdigest(user + ':' + realm + ':' + password)
</example>
</section>
</section>
</manualpage>---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
