From: Joe Orton Date: Thu, 17 Dec 2020 12:48:30 +0000 (+0000) Subject: Regenerate. [skip ci] X-Git-Tag: 2.5.0-alpha2-ci-test-only~1072 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ed3ad3922c4654616d02c50c5c63303792e8e299;p=thirdparty%2Fapache%2Fhttpd.git Regenerate. [skip ci] git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1884553 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/docs/manual/mod/directives.html.en.utf8 b/docs/manual/mod/directives.html.en.utf8 index 8f437a1c41c..b10f920885e 100644 --- a/docs/manual/mod/directives.html.en.utf8 +++ b/docs/manual/mod/directives.html.en.utf8 @@ -314,6 +314,8 @@
  • FirehoseProxyConnectionOutput
  • FirehoseRequestInput
  • FirehoseRequestOutput
    • +
  • FlushMaxPipelined
    • +
  • FlushMaxThreshold
  • ForceLanguagePriority
  • ForceType
  • ForensicLog
    • @@ -592,7 +594,8 @@
  • ProxyWebsocketAsyncDelay
  • ProxyWebsocketIdleTimeout
  • QualifyRedirectURL
    • -
  • ReadmeName
    • +
  • ReadBufferSize
    • +
  • ReadmeName
  • ReceiveBufferSize
  • Redirect
  • RedirectMatch
    • diff --git a/docs/manual/mod/mod_ssl.html.en.utf8 b/docs/manual/mod/mod_ssl.html.en.utf8 index 7c7ad496f87..060450e9137 100644 --- a/docs/manual/mod/mod_ssl.html.en.utf8 +++ b/docs/manual/mod/mod_ssl.html.en.utf8 @@ -1935,7 +1935,8 @@ SSLProxyCACertificateFile.

    Context:server config, virtual host, proxy section Status:Extension Module:mod_ssl -Compatibility:The proxy section context is allowed in httpd 2.4.30 and later +Compatibility:The proxy section context is allowed in httpd 2.4.30 and later
    +Inclusion of non-leaf (CA) certificates is permitted in httpd 2.5.1 and later.

    This directive sets the all-in-one file where you keep the certificates and @@ -1946,7 +1947,8 @@ This referenced file is simply the concatenation of the various PEM-encoded certificate files. Use this directive alternatively or additionally to SSLProxyMachineCertificatePath. The referenced file can contain any number of pairs of client certificate and associated private key. Each pair can be specified in -either (certificate, key) or (key, certificate) order.

    +either (certificate, key) or (key, certificate) order. Non-leaf (CA) certificates can +also be included in the file, and will treated as if configured with SSLProxyMachineCertificateChainFile.

    When challenged to provide a client certificate by a remote server, the server should provide a list of acceptable certificate @@ -1957,7 +1959,7 @@ client cert/key. If a list of CA names is provided, to find a configured client cert which was issued either directly by that CA, or indirectly via any number of intermediary CA certificates. The chain of intermediate CA certificates can be built from those -configured with SSLProxyMachineCertificateChainFile. The +included in the file, or configured with SSLProxyMachineCertificateChainFile. The first configured matching certificate will then be supplied in response to the challenge.

    diff --git a/docs/manual/mod/quickreference.html.en.utf8 b/docs/manual/mod/quickreference.html.en.utf8 index ea3fc260e1c..2b33a3cc6c0 100644 --- a/docs/manual/mod/quickreference.html.en.utf8 +++ b/docs/manual/mod/quickreference.html.en.utf8 @@ -131,8 +131,8 @@ proxy be passed through AllowHandlers [not] none|handler-name [none|handler-name]... all dXRestrict access to the listed handlers -AllowMethods reset|HTTP-method -[HTTP-method]... reset dXRestrict access to the listed HTTP methods +AllowMethods reset | [+|-]HTTP-method +[ [+|-]HTTP-method ] ... reset dXRestrict access to the listed HTTP methods AllowOverride All|None|directive-type [directive-type] ... None (2.3.9 and lat +dCTypes of directives that are allowed in .htaccess files @@ -504,6 +504,10 @@ filenames FirehoseProxyConnectionOutput [ block | nonblock ] filenamesECapture traffic sent out from the back of mod_proxy FirehoseRequestInput [ block | nonblock ] filenamesECapture traffic coming into the server on each request FirehoseRequestOutput [ block | nonblock ] filenamesECapture traffic going out of the server on each request +FlushMaxPipelined number 5 svCMaximum number of pipelined responses above which they are flushed +to the network +FlushMaxThresholdnumber-of-bytes 65536 svCThreshold above which pending data are flushed to the +network ForceLanguagePriority None|Prefer|Fallback [Prefer|Fallback] Prefer svdhBAction to take if a single acceptable document is not found ForceType media-type|NonedhCForces all matching files to be served with the specified @@ -917,345 +921,346 @@ header for proxied requests ProxyWebsocketIdleTimeout num[ms] 0 svESets the maximum amount of time to wait for data on the websockets tunnel QualifyRedirectURL On|Off Off svdCControls whether the REDIRECT_URL environment variable is fully qualified -ReadmeName filenamesvdhBName of the file that will be inserted at the end +ReadBufferSize bytes 8192 svdCSize of the buffers used to read data +ReadmeName filenamesvdhBName of the file that will be inserted at the end of the index listing -ReceiveBufferSize bytes 0 sMTCP receive buffer size -Redirect [status] [URL-path] -URLsvdhBSends an external redirect asking the client to fetch +ReceiveBufferSize bytes 0 sMTCP receive buffer size +Redirect [status] [URL-path] +URLsvdhBSends an external redirect asking the client to fetch a different URL -RedirectMatch [status] regex -URLsvdhBSends an external redirect based on a regular expression match +RedirectMatch [status] regex +URLsvdhBSends an external redirect based on a regular expression match of the current URL -RedirectPermanent URL-path URLsvdhBSends an external permanent redirect asking the client to fetch +RedirectPermanent URL-path URLsvdhBSends an external permanent redirect asking the client to fetch a different URL -RedirectRelative OFF|ON OFF svdBAllows relative redirect targets. -RedirectTemp URL-path URLsvdhBSends an external temporary redirect asking the client to fetch +RedirectRelative OFF|ON OFF svdBAllows relative redirect targets. +RedirectTemp URL-path URLsvdhBSends an external temporary redirect asking the client to fetch a different URL -RedisConnPoolTTL num[units] 15s svETTL used for the connection pool with the Redis server(s) -RedisTimeout num[units] 5s svER/W timeout used for the connection with the Redis server(s) -ReflectorHeader inputheader [outputheader]svdhBReflect an input header to the output headers -RegexDefaultOptions [none] [+|-]option [[+|-]option] ... DOTALL DOLLAR_ENDON +sCAllow to configure global/default options for regexes -RegisterHttpMethod method [method [...]]sCRegister non-standard HTTP methods -RemoteIPHeader header-fieldsvBDeclare the header field which should be parsed for useragent IP addresses -RemoteIPInternalProxy proxy-ip|proxy-ip/subnet|hostname ...svBDeclare client intranet IP addresses trusted to present the RemoteIPHeader value -RemoteIPInternalProxyList filenamesvBDeclare client intranet IP addresses trusted to present the RemoteIPHeader value -RemoteIPProxiesHeader HeaderFieldNamesvBDeclare the header field which will record all intermediate IP addresses -RemoteIPProxyProtocol On|OffsvBEnable or disable PROXY protocol handling -RemoteIPProxyProtocolExceptions host|range [host|range] [host|range]svBDisable processing of PROXY header for certain hosts or networks -RemoteIPTrustedProxy proxy-ip|proxy-ip/subnet|hostname ...svBRestrict client IP addresses trusted to present the RemoteIPHeader value -RemoteIPTrustedProxyList filenamesvBRestrict client IP addresses trusted to present the RemoteIPHeader value -RemoveCharset extension [extension] -...vdhBRemoves any character set associations for a set of file +RedisConnPoolTTL num[units] 15s svETTL used for the connection pool with the Redis server(s) +RedisTimeout num[units] 5s svER/W timeout used for the connection with the Redis server(s) +ReflectorHeader inputheader [outputheader]svdhBReflect an input header to the output headers +RegexDefaultOptions [none] [+|-]option [[+|-]option] ... DOTALL DOLLAR_ENDON +sCAllow to configure global/default options for regexes +RegisterHttpMethod method [method [...]]sCRegister non-standard HTTP methods +RemoteIPHeader header-fieldsvBDeclare the header field which should be parsed for useragent IP addresses +RemoteIPInternalProxy proxy-ip|proxy-ip/subnet|hostname ...svBDeclare client intranet IP addresses trusted to present the RemoteIPHeader value +RemoteIPInternalProxyList filenamesvBDeclare client intranet IP addresses trusted to present the RemoteIPHeader value +RemoteIPProxiesHeader HeaderFieldNamesvBDeclare the header field which will record all intermediate IP addresses +RemoteIPProxyProtocol On|OffsvBEnable or disable PROXY protocol handling +RemoteIPProxyProtocolExceptions host|range [host|range] [host|range]svBDisable processing of PROXY header for certain hosts or networks +RemoteIPTrustedProxy proxy-ip|proxy-ip/subnet|hostname ...svBRestrict client IP addresses trusted to present the RemoteIPHeader value +RemoteIPTrustedProxyList filenamesvBRestrict client IP addresses trusted to present the RemoteIPHeader value +RemoveCharset extension [extension] +...vdhBRemoves any character set associations for a set of file extensions -RemoveEncoding extension [extension] -...vdhBRemoves any content encoding associations for a set of file +RemoveEncoding extension [extension] +...vdhBRemoves any content encoding associations for a set of file extensions -RemoveHandler extension [extension] -...vdhBRemoves any handler associations for a set of file +RemoveHandler extension [extension] +...vdhBRemoves any handler associations for a set of file extensions -RemoveInputFilter extension [extension] -...vdhBRemoves any input filter associations for a set of file +RemoveInputFilter extension [extension] +...vdhBRemoves any input filter associations for a set of file extensions -RemoveLanguage extension [extension] -...vdhBRemoves any language associations for a set of file +RemoveLanguage extension [extension] +...vdhBRemoves any language associations for a set of file extensions -RemoveOutputFilter extension [extension] -...vdhBRemoves any output filter associations for a set of file +RemoveOutputFilter extension [extension] +...vdhBRemoves any output filter associations for a set of file extensions -RemoveType extension [extension] -...vdhBRemoves any content type associations for a set of file +RemoveType extension [extension] +...vdhBRemoves any content type associations for a set of file extensions -RequestHeader add|append|edit|edit*|merge|set|setifempty|unset +RequestHeader add|append|edit|edit*|merge|set|setifempty|unset header [[expr=]value [replacement] [early|env=[!]varname|expr=expression]] -svdhEConfigure HTTP request headers -RequestReadTimeout +svdhEConfigure HTTP request headers +RequestReadTimeout [handshake=timeout[-maxtimeout][,MinRate=rate] [header=timeout[-maxtimeout][,MinRate=rate] [body=timeout[-maxtimeout][,MinRate=rate] - handshake=0 header= +svESet timeout values for completing the TLS handshake, receiving + handshake=0 header= +svESet timeout values for completing the TLS handshake, receiving the request headers and/or body from client. -Require [not] entity-name - [entity-name] ...dhBTests whether an authenticated user is authorized by +Require [not] entity-name + [entity-name] ...dhBTests whether an authenticated user is authorized by an authorization provider. -<RequireAll> ... </RequireAll>dhBEnclose a group of authorization directives of which none +<RequireAll> ... </RequireAll>dhBEnclose a group of authorization directives of which none must fail and at least one must succeed for the enclosing directive to succeed. -<RequireAny> ... </RequireAny>dhBEnclose a group of authorization directives of which one +<RequireAny> ... </RequireAny>dhBEnclose a group of authorization directives of which one must succeed for the enclosing directive to succeed. -<RequireNone> ... </RequireNone>dhBEnclose a group of authorization directives of which none +<RequireNone> ... </RequireNone>dhBEnclose a group of authorization directives of which none must succeed for the enclosing directive to not fail. -RewriteBase URL-pathdhESets the base URL for per-directory rewrites - RewriteCond - TestString CondPattern [flags]svdhEDefines a condition under which rewriting will take place +RewriteBase URL-pathdhESets the base URL for per-directory rewrites + RewriteCond + TestString CondPattern [flags]svdhEDefines a condition under which rewriting will take place -RewriteEngine on|off off svdhEEnables or disables runtime rewriting engine -RewriteMap MapName MapType:MapSource +RewriteEngine on|off off svdhEEnables or disables runtime rewriting engine +RewriteMap MapName MapType:MapSource [MapTypeOptions] -svEDefines a mapping function for key-lookup -RewriteOptions OptionssvdhESets some special options for the rewrite engine -RewriteRule - Pattern Substitution [flags]svdhEDefines rules for the rewriting engine -RLimitCPU seconds|max [seconds|max]svdhCLimits the CPU consumption of processes launched +svEDefines a mapping function for key-lookup +RewriteOptions OptionssvdhESets some special options for the rewrite engine +RewriteRule + Pattern Substitution [flags]svdhEDefines rules for the rewriting engine +RLimitCPU seconds|max [seconds|max]svdhCLimits the CPU consumption of processes launched by Apache httpd children -RLimitMEM bytes|max [bytes|max]svdhCLimits the memory consumption of processes launched +RLimitMEM bytes|max [bytes|max]svdhCLimits the memory consumption of processes launched by Apache httpd children -RLimitNPROC number|max [number|max]svdhCLimits the number of processes that can be launched by +RLimitNPROC number|max [number|max]svdhCLimits the number of processes that can be launched by processes launched by Apache httpd children -Satisfy Any|All All dhEInteraction between host-level access control and +Satisfy Any|All All dhEInteraction between host-level access control and user authentication -ScoreBoardFile file-path apache_runtime_stat +sMLocation of the file used to store coordination data for +ScoreBoardFile file-path apache_runtime_stat +sMLocation of the file used to store coordination data for the child processes -Script method cgi-scriptsvdBActivates a CGI script for a particular request +Script method cgi-scriptsvdBActivates a CGI script for a particular request method. -ScriptAlias [URL-path] -file-path|directory-pathsvdBMaps a URL to a filesystem location and designates the +ScriptAlias [URL-path] +file-path|directory-pathsvdBMaps a URL to a filesystem location and designates the target as a CGI script -ScriptAliasMatch regex -file-path|directory-pathsvBMaps a URL to a filesystem location using a regular expression +ScriptAliasMatch regex +file-path|directory-pathsvBMaps a URL to a filesystem location using a regular expression and designates the target as a CGI script -ScriptInterpreterSource Registry|Registry-Strict|Script Script svdhCTechnique for locating the interpreter for CGI +ScriptInterpreterSource Registry|Registry-Strict|Script Script svdhCTechnique for locating the interpreter for CGI scripts -ScriptLog file-pathsvBLocation of the CGI script error logfile -ScriptLogBuffer bytes 1024 svBMaximum amount of PUT or POST requests that will be recorded +ScriptLog file-pathsvBLocation of the CGI script error logfile +ScriptLogBuffer bytes 1024 svBMaximum amount of PUT or POST requests that will be recorded in the scriptlog -ScriptLogLength bytes 10385760 svBSize limit of the CGI script logfile -ScriptSock file-path cgisock sBThe filename prefix of the socket to use for communication with +ScriptLogLength bytes 10385760 svBSize limit of the CGI script logfile +ScriptSock file-path cgisock sBThe filename prefix of the socket to use for communication with the cgi daemon -SecureListen [IP-address:]portnumber -Certificate-Name [MUTUAL]sBEnables SSL encryption for the specified port -SeeRequestTail On|Off Off sCDetermine if mod_status displays the first 63 characters +SecureListen [IP-address:]portnumber +Certificate-Name [MUTUAL]sBEnables SSL encryption for the specified port +SeeRequestTail On|Off Off sCDetermine if mod_status displays the first 63 characters of a request or the last 63, assuming the request itself is greater than 63 chars. -SendBufferSize bytes 0 sMTCP buffer size -ServerAdmin email-address|URLsvCEmail address that the server includes in error +SendBufferSize bytes 0 sMTCP buffer size +ServerAdmin email-address|URLsvCEmail address that the server includes in error messages sent to the client -ServerAlias hostname [hostname] ...vCAlternate names for a host used when matching requests +ServerAlias hostname [hostname] ...vCAlternate names for a host used when matching requests to name-virtual hosts -ServerLimit numbersMUpper limit on configurable number of processes -ServerName [scheme://]domain-name|ip-address[:port]svCHostname and port that the server uses to identify +ServerLimit numbersMUpper limit on configurable number of processes +ServerName [scheme://]domain-name|ip-address[:port]svCHostname and port that the server uses to identify itself -ServerPath URL-pathvCLegacy URL pathname for a name-based virtual host that +ServerPath URL-pathvCLegacy URL pathname for a name-based virtual host that is accessed by an incompatible browser -ServerRoot directory-path /usr/local/apache sCBase directory for the server installation -ServerSignature On|Off|EMail Off svdhCConfigures the footer on server-generated documents -ServerTokens Major|Minor|Min[imal]|Prod[uctOnly]|OS|Full Full sCConfigures the Server HTTP response +ServerRoot directory-path /usr/local/apache sCBase directory for the server installation +ServerSignature On|Off|EMail Off svdhCConfigures the footer on server-generated documents +ServerTokens Major|Minor|Min[imal]|Prod[uctOnly]|OS|Full Full sCConfigures the Server HTTP response header -Session On|Off Off svdhEEnables a session for the current directory or location -SessionCookieMaxAge On|Off On svdhEControl whether session cookies have Max-Age transmitted to the client -SessionCookieName name attributessvdhEName and attributes for the RFC2109 cookie storing the session -SessionCookieName2 name attributessvdhEName and attributes for the RFC2965 cookie storing the session -SessionCookieRemove On|Off Off svdhEControl for whether session cookies should be removed from incoming HTTP headers -SessionCryptoCipher name aes256 svdhXThe crypto cipher to be used to encrypt the session -SessionCryptoDriver name [param[=value]]sXThe crypto driver to be used to encrypt the session -SessionCryptoPassphrase secret [ secret ... ] svdhXThe key used to encrypt the session -SessionCryptoPassphraseFile filenamesvdXFile containing keys used to encrypt the session -SessionDBDCookieName name attributessvdhEName and attributes for the RFC2109 cookie storing the session ID -SessionDBDCookieName2 name attributessvdhEName and attributes for the RFC2965 cookie storing the session ID -SessionDBDCookieRemove On|Off On svdhEControl for whether session ID cookies should be removed from incoming HTTP headers -SessionDBDDeleteLabel label deletesession svdhEThe SQL query to use to remove sessions from the database -SessionDBDInsertLabel label insertsession svdhEThe SQL query to use to insert sessions into the database -SessionDBDPerUser On|Off Off svdhEEnable a per user session -SessionDBDSelectLabel label selectsession svdhEThe SQL query to use to select sessions from the database -SessionDBDUpdateLabel label updatesession svdhEThe SQL query to use to update existing sessions in the database -SessionEnv On|Off Off svdhEControl whether the contents of the session are written to the +Session On|Off Off svdhEEnables a session for the current directory or location +SessionCookieMaxAge On|Off On svdhEControl whether session cookies have Max-Age transmitted to the client +SessionCookieName name attributessvdhEName and attributes for the RFC2109 cookie storing the session +SessionCookieName2 name attributessvdhEName and attributes for the RFC2965 cookie storing the session +SessionCookieRemove On|Off Off svdhEControl for whether session cookies should be removed from incoming HTTP headers +SessionCryptoCipher name aes256 svdhXThe crypto cipher to be used to encrypt the session +SessionCryptoDriver name [param[=value]]sXThe crypto driver to be used to encrypt the session +SessionCryptoPassphrase secret [ secret ... ] svdhXThe key used to encrypt the session +SessionCryptoPassphraseFile filenamesvdXFile containing keys used to encrypt the session +SessionDBDCookieName name attributessvdhEName and attributes for the RFC2109 cookie storing the session ID +SessionDBDCookieName2 name attributessvdhEName and attributes for the RFC2965 cookie storing the session ID +SessionDBDCookieRemove On|Off On svdhEControl for whether session ID cookies should be removed from incoming HTTP headers +SessionDBDDeleteLabel label deletesession svdhEThe SQL query to use to remove sessions from the database +SessionDBDInsertLabel label insertsession svdhEThe SQL query to use to insert sessions into the database +SessionDBDPerUser On|Off Off svdhEEnable a per user session +SessionDBDSelectLabel label selectsession svdhEThe SQL query to use to select sessions from the database +SessionDBDUpdateLabel label updatesession svdhEThe SQL query to use to update existing sessions in the database +SessionEnv On|Off Off svdhEControl whether the contents of the session are written to the HTTP_SESSION environment variable -SessionExclude pathsvdhEDefine URL prefixes for which a session is ignored -SessionExpiryUpdateInterval interval 0 (always update) svdhEDefine the number of seconds a session's expiry may change without +SessionExclude pathsvdhEDefine URL prefixes for which a session is ignored +SessionExpiryUpdateInterval interval 0 (always update) svdhEDefine the number of seconds a session's expiry may change without the session being updated -SessionHeader headersvdhEImport session updates from a given HTTP response header -SessionInclude pathsvdhEDefine URL prefixes for which a session is valid -SessionMaxAge maxage 0 svdhEDefine a maximum age in seconds for a session -SetEnv env-variable [value]svdhBSets environment variables -SetEnvIf attribute +SessionHeader headersvdhEImport session updates from a given HTTP response header +SessionInclude pathsvdhEDefine URL prefixes for which a session is valid +SessionMaxAge maxage 0 svdhEDefine a maximum age in seconds for a session +SetEnv env-variable [value]svdhBSets environment variables +SetEnvIf attribute regex [!]env-variable[=value] - [[!]env-variable[=value]] ...svdhBSets environment variables based on attributes of the request + [[!]env-variable[=value]] ...svdhBSets environment variables based on attributes of the request -SetEnvIfExpr expr +SetEnvIfExpr expr [!]env-variable[=value] - [[!]env-variable[=value]] ...svdhBSets environment variables based on an ap_expr expression -SetEnvIfNoCase attribute regex + [[!]env-variable[=value]] ...svdhBSets environment variables based on an ap_expr expression +SetEnvIfNoCase attribute regex [!]env-variable[=value] - [[!]env-variable[=value]] ...svdhBSets environment variables based on attributes of the request + [[!]env-variable[=value]] ...svdhBSets environment variables based on attributes of the request without respect to case -SetHandler handler-name|none|expressionsvdhCForces all matching files to be processed by a +SetHandler handler-name|none|expressionsvdhCForces all matching files to be processed by a handler -SetInputFilter filter[;filter...]svdhCSets the filters that will process client requests and POST +SetInputFilter filter[;filter...]svdhCSets the filters that will process client requests and POST input -SetOutputFilter filter[;filter...]svdhCSets the filters that will process responses from the +SetOutputFilter filter[;filter...]svdhCSets the filters that will process responses from the server -SSIEndTag tag "-->" svBString that ends an include element -SSIErrorMsg message "[an error occurred +svdhBError message displayed when there is an SSI +SSIEndTag tag "-->" svBString that ends an include element +SSIErrorMsg message "[an error occurred +svdhBError message displayed when there is an SSI error -SSIETag on|off off dhBControls whether ETags are generated by the server. -SSILastModified on|off off dhBControls whether Last-Modified headers are generated by the +SSIETag on|off off dhBControls whether ETags are generated by the server. +SSILastModified on|off off dhBControls whether Last-Modified headers are generated by the server. -SSILegacyExprParser on|off off dhBEnable compatibility mode for conditional expressions. -SSIStartTag tag "<!--#" svBString that starts an include element -SSITimeFormat formatstring "%A, %d-%b-%Y %H:%M +svdhBConfigures the format in which date strings are +SSILegacyExprParser on|off off dhBEnable compatibility mode for conditional expressions. +SSIStartTag tag "<!--#" svBString that starts an include element +SSITimeFormat formatstring "%A, %d-%b-%Y %H:%M +svdhBConfigures the format in which date strings are displayed -SSIUndefinedEcho string "(none)" svdhBString displayed when an unset variable is echoed -SSLCACertificateFile file-pathsvEFile of concatenated PEM-encoded CA Certificates +SSIUndefinedEcho string "(none)" svdhBString displayed when an unset variable is echoed +SSLCACertificateFile file-pathsvEFile of concatenated PEM-encoded CA Certificates for Client Auth -SSLCACertificatePath directory-pathsvEDirectory of PEM-encoded CA Certificates for +SSLCACertificatePath directory-pathsvEDirectory of PEM-encoded CA Certificates for Client Auth -SSLCADNRequestFile file-pathsvEFile of concatenated PEM-encoded CA Certificates +SSLCADNRequestFile file-pathsvEFile of concatenated PEM-encoded CA Certificates for defining acceptable CA names -SSLCADNRequestPath directory-pathsvEDirectory of PEM-encoded CA Certificates for +SSLCADNRequestPath directory-pathsvEDirectory of PEM-encoded CA Certificates for defining acceptable CA names -SSLCARevocationCheck chain|leaf|none [flags ...] none svEEnable CRL-based revocation checking -SSLCARevocationFile file-pathsvEFile of concatenated PEM-encoded CA CRLs for +SSLCARevocationCheck chain|leaf|none [flags ...] none svEEnable CRL-based revocation checking +SSLCARevocationFile file-pathsvEFile of concatenated PEM-encoded CA CRLs for Client Auth -SSLCARevocationPath directory-pathsvEDirectory of PEM-encoded CA CRLs for +SSLCARevocationPath directory-pathsvEDirectory of PEM-encoded CA CRLs for Client Auth -SSLCertificateChainFile file-pathsvEFile of PEM-encoded Server CA Certificates -SSLCertificateFile file-path|certidsvEServer PEM-encoded X.509 certificate data file or token identifier -SSLCertificateKeyFile file-path|keyidsvEServer PEM-encoded private key file -SSLCipherSuite [protocol] cipher-spec DEFAULT (depends on +svdhECipher Suite available for negotiation in SSL +SSLCertificateChainFile file-pathsvEFile of PEM-encoded Server CA Certificates +SSLCertificateFile file-path|certidsvEServer PEM-encoded X.509 certificate data file or token identifier +SSLCertificateKeyFile file-path|keyidsvEServer PEM-encoded private key file +SSLCipherSuite [protocol] cipher-spec DEFAULT (depends on +svdhECipher Suite available for negotiation in SSL handshake -SSLCompression on|off off svEEnable compression on the SSL level -SSLCryptoDevice engine builtin sEEnable use of a cryptographic hardware accelerator -SSLEngine on|off|optional off svESSL Engine Operation Switch -SSLFIPS on|off off sESSL FIPS mode Switch -SSLHonorCipherOrder on|off off svEOption to prefer the server's cipher preference order -SSLInsecureRenegotiation on|off off svEOption to enable support for insecure renegotiation -SSLOCSPDefaultResponder urisvESet the default responder URI for OCSP validation -SSLOCSPEnable on|leaf|off off svEEnable OCSP validation of the client certificate chain -SSLOCSPNoverify on|off off svEskip the OCSP responder certificates verification -SSLOCSPOverrideResponder on|off off svEForce use of the default responder URI for OCSP validation -SSLOCSPProxyURL urlsvEProxy URL to use for OCSP requests -SSLOCSPResponderCertificateFile filesvESet of trusted PEM encoded OCSP responder certificates -SSLOCSPResponderTimeout seconds 10 svETimeout for OCSP queries -SSLOCSPResponseMaxAge seconds -1 svEMaximum allowable age for OCSP responses -SSLOCSPResponseTimeSkew seconds 300 svEMaximum allowable time skew for OCSP response validation -SSLOCSPUseRequestNonce on|off on svEUse a nonce within OCSP queries -SSLOpenSSLConfCmd command-name command-valuesvEConfigure OpenSSL parameters through its SSL_CONF API -SSLOptions [+|-]option ...svdhEConfigure various SSL engine run-time options -SSLPassPhraseDialog type builtin sEType of pass phrase dialog for encrypted private +SSLCompression on|off off svEEnable compression on the SSL level +SSLCryptoDevice engine builtin sEEnable use of a cryptographic hardware accelerator +SSLEngine on|off|optional off svESSL Engine Operation Switch +SSLFIPS on|off off sESSL FIPS mode Switch +SSLHonorCipherOrder on|off off svEOption to prefer the server's cipher preference order +SSLInsecureRenegotiation on|off off svEOption to enable support for insecure renegotiation +SSLOCSPDefaultResponder urisvESet the default responder URI for OCSP validation +SSLOCSPEnable on|leaf|off off svEEnable OCSP validation of the client certificate chain +SSLOCSPNoverify on|off off svEskip the OCSP responder certificates verification +SSLOCSPOverrideResponder on|off off svEForce use of the default responder URI for OCSP validation +SSLOCSPProxyURL urlsvEProxy URL to use for OCSP requests +SSLOCSPResponderCertificateFile filesvESet of trusted PEM encoded OCSP responder certificates +SSLOCSPResponderTimeout seconds 10 svETimeout for OCSP queries +SSLOCSPResponseMaxAge seconds -1 svEMaximum allowable age for OCSP responses +SSLOCSPResponseTimeSkew seconds 300 svEMaximum allowable time skew for OCSP response validation +SSLOCSPUseRequestNonce on|off on svEUse a nonce within OCSP queries +SSLOpenSSLConfCmd command-name command-valuesvEConfigure OpenSSL parameters through its SSL_CONF API +SSLOptions [+|-]option ...svdhEConfigure various SSL engine run-time options +SSLPassPhraseDialog type builtin sEType of pass phrase dialog for encrypted private keys -SSLPolicy namesvEApply a SSLPolicy by name -SSLProtocol [+|-]protocol ... all -SSLv3 svEConfigure usable SSL/TLS protocol versions -SSLProxyCACertificateFile file-pathsvpEFile of concatenated PEM-encoded CA Certificates +SSLPolicy namesvEApply a SSLPolicy by name +SSLProtocol [+|-]protocol ... all -SSLv3 svEConfigure usable SSL/TLS protocol versions +SSLProxyCACertificateFile file-pathsvpEFile of concatenated PEM-encoded CA Certificates for Remote Server Auth -SSLProxyCACertificatePath directory-pathsvpEDirectory of PEM-encoded CA Certificates for +SSLProxyCACertificatePath directory-pathsvpEDirectory of PEM-encoded CA Certificates for Remote Server Auth -SSLProxyCARevocationCheck chain|leaf|none none svpEEnable CRL-based revocation checking for Remote Server Auth -SSLProxyCARevocationFile file-pathsvpEFile of concatenated PEM-encoded CA CRLs for +SSLProxyCARevocationCheck chain|leaf|none none svpEEnable CRL-based revocation checking for Remote Server Auth +SSLProxyCARevocationFile file-pathsvpEFile of concatenated PEM-encoded CA CRLs for Remote Server Auth -SSLProxyCARevocationPath directory-pathsvpEDirectory of PEM-encoded CA CRLs for +SSLProxyCARevocationPath directory-pathsvpEDirectory of PEM-encoded CA CRLs for Remote Server Auth -SSLProxyCheckPeerCN on|off on svpEWhether to check the remote server certificate's CN field +SSLProxyCheckPeerCN on|off on svpEWhether to check the remote server certificate's CN field -SSLProxyCheckPeerExpire on|off on svpEWhether to check if remote server certificate is expired +SSLProxyCheckPeerExpire on|off on svpEWhether to check if remote server certificate is expired -SSLProxyCheckPeerName on|off on svpEConfigure host name checking for remote server certificates +SSLProxyCheckPeerName on|off on svpEConfigure host name checking for remote server certificates -SSLProxyCipherSuite [protocol] cipher-spec ALL:!ADH:RC4+RSA:+H +svpECipher Suite available for negotiation in SSL +SSLProxyCipherSuite [protocol] cipher-spec ALL:!ADH:RC4+RSA:+H +svpECipher Suite available for negotiation in SSL proxy handshake -SSLProxyEngine on|off off svpESSL Proxy Engine Operation Switch -SSLProxyMachineCertificateChainFile filenamesvpEFile of concatenated PEM-encoded CA certificates to be used by the proxy for choosing a certificate -SSLProxyMachineCertificateFile filenamesvpEFile of concatenated PEM-encoded client certificates and keys to be used by the proxy -SSLProxyMachineCertificatePath directorysvpEDirectory of PEM-encoded client certificates and keys to be used by the proxy -SSLProxyProtocol [+|-]protocol ... all -SSLv3 svpEConfigure usable SSL protocol flavors for proxy usage -SSLProxyVerify level none svpEType of remote server Certificate verification -SSLProxyVerifyDepth number 1 svpEMaximum depth of CA Certificates in Remote Server +SSLProxyEngine on|off off svpESSL Proxy Engine Operation Switch +SSLProxyMachineCertificateChainFile filenamesvpEFile of concatenated PEM-encoded CA certificates to be used by the proxy for choosing a certificate +SSLProxyMachineCertificateFile filenamesvpEFile of concatenated PEM-encoded client certificates and keys to be used by the proxy +SSLProxyMachineCertificatePath directorysvpEDirectory of PEM-encoded client certificates and keys to be used by the proxy +SSLProxyProtocol [+|-]protocol ... all -SSLv3 svpEConfigure usable SSL protocol flavors for proxy usage +SSLProxyVerify level none svpEType of remote server Certificate verification +SSLProxyVerifyDepth number 1 svpEMaximum depth of CA Certificates in Remote Server Certificate verification -SSLRandomSeed context source -[bytes]sEPseudo Random Number Generator (PRNG) seeding +SSLRandomSeed context source +[bytes]sEPseudo Random Number Generator (PRNG) seeding source -SSLRenegBufferSize bytes 131072 dhESet the size for the SSL renegotiation buffer -SSLRequire expressiondhEAllow access only when an arbitrarily complex +SSLRenegBufferSize bytes 131072 dhESet the size for the SSL renegotiation buffer +SSLRequire expressiondhEAllow access only when an arbitrarily complex boolean expression is true -SSLRequireSSLdhEDeny access when SSL is not used for the +SSLRequireSSLdhEDeny access when SSL is not used for the HTTP request -SSLSessionCache type none sEType of the global/inter-process SSL Session +SSLSessionCache type none sEType of the global/inter-process SSL Session Cache -SSLSessionCacheTimeout seconds 300 svENumber of seconds before an SSL session expires +SSLSessionCacheTimeout seconds 300 svENumber of seconds before an SSL session expires in the Session Cache -SSLSessionTicketKeyFile file-pathsvEPersistent encryption/decryption key for TLS session tickets -SSLSessionTickets on|off on svEEnable or disable use of TLS session tickets -SSLSRPUnknownUserSeed secret-stringsvESRP unknown user seed -SSLSRPVerifierFile file-pathsvEPath to SRP verifier file -SSLStaplingCache typesEConfigures the OCSP stapling cache -SSLStaplingErrorCacheTimeout seconds 600 svENumber of seconds before expiring invalid responses in the OCSP stapling cache -SSLStaplingFakeTryLater on|off on svESynthesize "tryLater" responses for failed OCSP stapling queries -SSLStaplingForceURL urisvEOverride the OCSP responder URI specified in the certificate's AIA extension -SSLStaplingResponderTimeout seconds 10 svETimeout for OCSP stapling queries -SSLStaplingResponseMaxAge seconds -1 svEMaximum allowable age for OCSP stapling responses -SSLStaplingResponseTimeSkew seconds 300 svEMaximum allowable time skew for OCSP stapling response validation -SSLStaplingReturnResponderErrors on|off on svEPass stapling related OCSP errors on to client -SSLStaplingStandardCacheTimeout seconds 3600 svENumber of seconds before expiring responses in the OCSP stapling cache -SSLStrictSNIVHostCheck on|off off svEWhether to allow non-SNI clients to access a name-based virtual +SSLSessionTicketKeyFile file-pathsvEPersistent encryption/decryption key for TLS session tickets +SSLSessionTickets on|off on svEEnable or disable use of TLS session tickets +SSLSRPUnknownUserSeed secret-stringsvESRP unknown user seed +SSLSRPVerifierFile file-pathsvEPath to SRP verifier file +SSLStaplingCache typesEConfigures the OCSP stapling cache +SSLStaplingErrorCacheTimeout seconds 600 svENumber of seconds before expiring invalid responses in the OCSP stapling cache +SSLStaplingFakeTryLater on|off on svESynthesize "tryLater" responses for failed OCSP stapling queries +SSLStaplingForceURL urisvEOverride the OCSP responder URI specified in the certificate's AIA extension +SSLStaplingResponderTimeout seconds 10 svETimeout for OCSP stapling queries +SSLStaplingResponseMaxAge seconds -1 svEMaximum allowable age for OCSP stapling responses +SSLStaplingResponseTimeSkew seconds 300 svEMaximum allowable time skew for OCSP stapling response validation +SSLStaplingReturnResponderErrors on|off on svEPass stapling related OCSP errors on to client +SSLStaplingStandardCacheTimeout seconds 3600 svENumber of seconds before expiring responses in the OCSP stapling cache +SSLStrictSNIVHostCheck on|off off svEWhether to allow non-SNI clients to access a name-based virtual host. -SSLUserName varnamesdhEVariable name to determine user name -SSLUseStapling on|off off svEEnable stapling of OCSP responses in the TLS handshake -SSLVerifyClient level none svdhEType of Client Certificate verification -SSLVerifyDepth number 1 svdhEMaximum depth of CA Certificates in Client +SSLUserName varnamesdhEVariable name to determine user name +SSLUseStapling on|off off svEEnable stapling of OCSP responses in the TLS handshake +SSLVerifyClient level none svdhEType of Client Certificate verification +SSLVerifyDepth number 1 svdhEMaximum depth of CA Certificates in Client Certificate verification -StartServers numbersMNumber of child server processes created at startup -StartThreads numbersMNumber of threads created on startup -StrictHostCheck ON|OFF OFF svCControls whether the server requires the requested hostname be +StartServers numbersMNumber of child server processes created at startup +StartThreads numbersMNumber of threads created on startup +StrictHostCheck ON|OFF OFF svCControls whether the server requires the requested hostname be listed enumerated in the virtual host handling the request -Substitute s/pattern/substitution/[infq]dhEPattern to filter the response content -SubstituteInheritBefore on|off on dhEChange the merge order of inherited patterns -SubstituteMaxLineLength bytes(b|B|k|K|m|M|g|G) 1m dhESet the maximum line size -Suexec On|OffsBEnable or disable the suEXEC feature -SuexecUserGroup User GroupsvEUser and group for CGI programs to run as -ThreadLimit numbersMSets the upper limit on the configurable number of threads +Substitute s/pattern/substitution/[infq]dhEPattern to filter the response content +SubstituteInheritBefore on|off on dhEChange the merge order of inherited patterns +SubstituteMaxLineLength bytes(b|B|k|K|m|M|g|G) 1m dhESet the maximum line size +Suexec On|OffsBEnable or disable the suEXEC feature +SuexecUserGroup User GroupsvEUser and group for CGI programs to run as +ThreadLimit numbersMSets the upper limit on the configurable number of threads per child process -ThreadsPerChild numbersMNumber of threads created by each child process -ThreadStackSize sizesMThe size in bytes of the stack used by threads handling +ThreadsPerChild numbersMNumber of threads created by each child process +ThreadStackSize sizesMThe size in bytes of the stack used by threads handling client connections -TimeOut time-interval[s] 60 svCAmount of time the server will wait for +TimeOut time-interval[s] 60 svCAmount of time the server will wait for certain events before failing a request -TraceEnable [on|off|extended] on svCDetermines the behavior on TRACE requests -TransferLog file|pipesvBSpecify location of a log file -TypesConfig file-path conf/mime.types sBThe location of the mime.types file -UnDefine parameter-namesvCUndefine the existence of a variable -UndefMacro namesvdBUndefine a macro -UnsetEnv env-variable [env-variable] -...svdhBRemoves variables from the environment -Use name [value1 ... valueN] -svdBUse a macro -UseCanonicalName On|Off|DNS Off svdCConfigures how the server determines its own name and +TraceEnable [on|off|extended] on svCDetermines the behavior on TRACE requests +TransferLog file|pipesvBSpecify location of a log file +TypesConfig file-path conf/mime.types sBThe location of the mime.types file +UnDefine parameter-namesvCUndefine the existence of a variable +UndefMacro namesvdBUndefine a macro +UnsetEnv env-variable [env-variable] +...svdhBRemoves variables from the environment +Use name [value1 ... valueN] +svdBUse a macro +UseCanonicalName On|Off|DNS Off svdCConfigures how the server determines its own name and port -UseCanonicalPhysicalPort On|Off Off svdCConfigures how the server determines its own port -User unix-userid #-1 sBThe userid under which the server will answer +UseCanonicalPhysicalPort On|Off Off svdCConfigures how the server determines its own port +User unix-userid #-1 sBThe userid under which the server will answer requests -UserDir directory-filename [directory-filename] ... -svBLocation of the user-specific directories -VHostCGIMode On|Off|Secure On vXDetermines whether the virtualhost can run +UserDir directory-filename [directory-filename] ... +svBLocation of the user-specific directories +VHostCGIMode On|Off|Secure On vXDetermines whether the virtualhost can run subprocesses, and the privileges available to subprocesses. -VHostCGIPrivs [+-]?privilege-name [[+-]?privilege-name] ...vXAssign arbitrary privileges to subprocesses created +VHostCGIPrivs [+-]?privilege-name [[+-]?privilege-name] ...vXAssign arbitrary privileges to subprocesses created by a virtual host. -VHostGroup unix-groupidvXSets the Group ID under which a virtual host runs. -VHostPrivs [+-]?privilege-name [[+-]?privilege-name] ...vXAssign arbitrary privileges to a virtual host. -VHostSecure On|Off On vXDetermines whether the server runs with enhanced security +VHostGroup unix-groupidvXSets the Group ID under which a virtual host runs. +VHostPrivs [+-]?privilege-name [[+-]?privilege-name] ...vXAssign arbitrary privileges to a virtual host. +VHostSecure On|Off On vXDetermines whether the server runs with enhanced security for the virtualhost. -VHostUser unix-useridvXSets the User ID under which a virtual host runs. -VirtualDocumentRoot interpolated-directory|none none svEDynamically configure the location of the document root +VHostUser unix-useridvXSets the User ID under which a virtual host runs. +VirtualDocumentRoot interpolated-directory|none none svEDynamically configure the location of the document root for a given virtual host -VirtualDocumentRootIP interpolated-directory|none none svEDynamically configure the location of the document root +VirtualDocumentRootIP interpolated-directory|none none svEDynamically configure the location of the document root for a given virtual host -<VirtualHost +<VirtualHost addr[:port] [addr[:port]] - ...> ... </VirtualHost>sCContains directives that apply only to a specific + ...> ... </VirtualHost>sCContains directives that apply only to a specific hostname or IP address -VirtualScriptAlias interpolated-directory|none none svEDynamically configure the location of the CGI directory for +VirtualScriptAlias interpolated-directory|none none svEDynamically configure the location of the CGI directory for a given virtual host -VirtualScriptAliasIP interpolated-directory|none none svEDynamically configure the location of the CGI directory for +VirtualScriptAliasIP interpolated-directory|none none svEDynamically configure the location of the CGI directory for a given virtual host -Warning messagesvdhCWarn from configuration parsing with a custom message -WatchdogInterval time-interval[s] 1 sBWatchdog interval in seconds -XBitHack on|off|full off svdhBParse SSI directives in files with the execute bit +Warning messagesvdhCWarn from configuration parsing with a custom message +WatchdogInterval time-interval[s] 1 sBWatchdog interval in seconds +XBitHack on|off|full off svdhBParse SSI directives in files with the execute bit set -xml2EncAlias charset alias [alias ...]sBRecognise Aliases for encoding values -xml2EncDefault namesvdhBSets a default encoding to assume when absolutely no information +xml2EncAlias charset alias [alias ...]sBRecognise Aliases for encoding values +xml2EncDefault namesvdhBSets a default encoding to assume when absolutely no information can be automatically detected -xml2StartParse element [element ...]svdhBAdvise the parser to skip leading junk. +xml2StartParse element [element ...]svdhBAdvise the parser to skip leading junk.

    Available Languages:  de  | diff --git a/docs/manual/programs/dbmmanage.html.en.utf8 b/docs/manual/programs/dbmmanage.html.en.utf8 index b9ec4129422..27c3ad012a8 100644 --- a/docs/manual/programs/dbmmanage.html.en.utf8 +++ b/docs/manual/programs/dbmmanage.html.en.utf8 @@ -76,7 +76,7 @@ may not contain a colon (:).

    encpasswd
    -
    This is the already encrypted password to use for the +
    This is the already hashed password to use for the update and add commands. You may use a hyphen (-) if you want to get prompted for the password, but fill in the fields afterwards. Additionally when using the update @@ -99,13 +99,13 @@

    Encodings

    -d
    -
    crypt encryption (default, except on Win32, Netware)
    +
    crypt hashing (default, except on Win32, Netware)
    -m
    -
    MD5 encryption (default on Win32, Netware)
    +
    MD5 hashing (default on Win32, Netware)
    -s
    -
    SHA1 encryption
    +
    SHA1 hashing
    -p
    plaintext (not recommended)
    @@ -116,7 +116,7 @@
    add
    Adds an entry for username to filename using the - encrypted password encpasswd. + hashed password encpasswd.

    dbmmanage passwords.dat add rbowen foKntnEF3KSXA

    diff --git a/docs/manual/programs/htdbm.html.en.utf8 b/docs/manual/programs/htdbm.html.en.utf8 index 63e871ff548..6b8183ccee1 100644 --- a/docs/manual/programs/htdbm.html.en.utf8 +++ b/docs/manual/programs/htdbm.html.en.utf8 @@ -155,27 +155,27 @@ cannot be combined with the -c option.
    -m
    -
    Use MD5 encryption for passwords. On Windows and Netware, this is +
    Use MD5 hashing for passwords. On Windows and Netware, this is the default.
    -B
    -
    Use bcrypt encryption for passwords. This is currently considered to +
    Use bcrypt hashing for passwords. This is currently considered to be very secure.
    -C
    This flag is only allowed in combination with -B (bcrypt - encryption). It sets the computing time used for the bcrypt algorithm + hashing). It sets the computing time used for the bcrypt algorithm (higher is more secure but slower, default: 5, valid: 4 to 31).
    -d
    -
    Use crypt() encryption for passwords. The default on all +
    Use crypt() hashing for passwords. The default on all platforms but Windows and Netware. Though possibly supported by htdbm on all platforms, it is not supported by the httpd server on Windows and Netware. This algorithm is insecure by today's standards.
    -s
    -
    Use SHA encryption for passwords. Facilitates migration from/to Netscape +
    Use SHA hashing for passwords. Facilitates migration from/to Netscape servers using the LDAP Directory Interchange Format (ldif). This algorithm is insecure by today's standards.
    @@ -215,7 +215,7 @@ does exist, the password is changed.
    password
    -
    The plaintext password to be encrypted and stored in the DBM file. +
    The plaintext password to be hashed and stored in the DBM file. Used only with the -b flag.
    -TDBTYPE
    @@ -261,7 +261,7 @@

    Adds or modifies the password for user jsmith. The user is prompted for the password. If executed on a Windows system, the password - will be encrypted using the modified Apache MD5 algorithm; otherwise, the + will be hashed using the modified Apache MD5 algorithm; otherwise, the system's crypt() routine will be used. If the file does not exist, htdbm will do nothing except return an error.

    @@ -302,14 +302,14 @@ not be fetchable with a browser.

    The use of the -b option is discouraged, since when it is - used the unencrypted password appears on the command line.

    + used the plaintext password appears on the command line.

    When using the crypt() algorithm, note that only the first 8 characters of the password are used to form the password. If the supplied password is longer, the extra characters will be silently discarded.

    -

    The SHA encryption format does not use salting: for a given password, - there is only one encrypted representation. The crypt() and +

    The SHA hashing option does not use salting: for a given password, + there is only one hashed representation. The crypt() and MD5 formats permute the representation by prepending a random salt string, to make dictionary attacks against the passwords more difficult.

    @@ -318,13 +318,13 @@
    top

    Restrictions

    -

    On the Windows platform, passwords encrypted with +

    On the Windows platform, passwords hashed with htdbm are limited to no more than 255 characters in length. Longer passwords will be truncated to 255 characters.

    The MD5 algorithm used by htdbm is specific to the Apache - software; passwords encrypted using it will not be usable with other Web + software; passwords hashed using it will not be usable with other Web servers.

    Usernames are limited to 255 bytes and may not include the diff --git a/docs/manual/programs/htpasswd.html.en.utf8 b/docs/manual/programs/htpasswd.html.en.utf8 index 9bed0595e3c..d3a7f7fcf8e 100644 --- a/docs/manual/programs/htpasswd.html.en.utf8 +++ b/docs/manual/programs/htpasswd.html.en.utf8 @@ -38,18 +38,18 @@

    Resources available from the Apache HTTP server can be restricted to just the users listed in the files created by htpasswd. This program can only manage usernames and passwords stored in a flat-file. It - can encrypt and display password information for use in other types of data + can hash and display password information for use in other types of data stores, though. To use a DBM database see dbmmanage or htdbm.

    -

    htpasswd encrypts passwords using either bcrypt, a +

    htpasswd hashes passwords using either bcrypt, a version of MD5 modified for Apache, SHA-1, or the system's crypt() routine. SHA-2-based hashes (SHA-256 and SHA-512) are supported for crypt(). Files managed by htpasswd may contain a mixture of different encoding types of passwords; some user records may have bcrypt or - MD5-encrypted passwords while others in the same file may have - passwords encrypted with crypt().

    + MD5-hashed passwords while others in the same file may have + passwords hashed with crypt().

    This manual page only lists the command line arguments. For details of the directives necessary to configure user authentication in @@ -147,7 +147,7 @@ distribution.

  • Comments
    • one) is omitted. It cannot be combined with the -c option.
    -m
    -
    Use MD5 encryption for passwords. This is the default (since version +
    Use MD5 hashing for passwords. This is the default (since version 2.2.18).
    -2
    @@ -159,12 +159,12 @@ distribution.
  • Comments
    • supported on most Unix platforms.
    -B
    -
    Use bcrypt encryption for passwords. This is currently considered to +
    Use bcrypt hashing for passwords. This is currently considered to be very secure.
    -C
    This flag is only allowed in combination with -B (bcrypt - encryption). It sets the computing time used for the bcrypt algorithm + hashing). It sets the computing time used for the bcrypt algorithm (higher is more secure but slower, default: 5, valid: 4 to 17).
    -r
    @@ -174,14 +174,14 @@ distribution.
  • Comments
    • 5,000).
    -d
    -
    Use crypt() encryption for passwords. This is not +
    Use crypt() hashing for passwords. This is not supported by the httpd server on Windows and Netware. This algorithm limits the password length to 8 characters. This algorithm is insecure by today's standards. It used to be the default algorithm until version 2.2.17.
    -s
    -
    Use SHA-1 (160-bit) encryption for passwords. Facilitates migration +
    Use SHA-1 (160-bit) hashing for passwords. Facilitates migration from/to Netscape servers using the LDAP Directory Interchange Format (ldif). This algorithm is insecure by today's standards.
    @@ -211,7 +211,7 @@ distribution.
  • Comments
    • does exist, the password is changed.
    password
    -
    The plaintext password to be encrypted and stored in the file. Only +
    The plaintext password to be hashed and stored in the file. Only used with the -b flag.
    top
    @@ -236,7 +236,7 @@ distribution.
  • Comments

    • Adds or modifies the password for user jsmith. The user - is prompted for the password. The password will be encrypted using the + is prompted for the password. The password will be hashed using the modified Apache MD5 algorithm. If the file does not exist, htpasswd will do nothing except return an error.

    @@ -267,14 +267,14 @@ distribution.
  • Comments
    • setuid.

    The use of the -b option is discouraged, since when it is - used the unencrypted password appears on the command line.

    + used the plaintext password appears on the command line.

    When using the crypt() algorithm, note that only the first 8 characters of the password are used to form the password. If the supplied password is longer, the extra characters will be silently discarded.

    -

    The SHA-1 encryption format does not use salting: for a given - password, there is only one encrypted representation. The +

    The SHA-1 hashing format does not use salting: for a given + password, there is only one hashed representation. The crypt() and MD5 formats permute the representation by prepending a random salt string, to make dictionary attacks against the passwords more difficult.

    @@ -289,13 +289,13 @@ distribution.
  • Comments
    • top

    Restrictions

    -

    On the Windows platform, passwords encrypted with +

    On the Windows platform, passwords hashed with htpasswd are limited to no more than 255 characters in length. Longer passwords will be truncated to 255 characters.

    The MD5 algorithm used by htpasswd is specific to the Apache - software; passwords encrypted using it will not be usable with other Web + software; passwords hashed using it will not be usable with other Web servers.

    Usernames are limited to 255 bytes and may not include the