From b07aa54007cca2c208e567c29aa4a2af15035a08 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 2 Apr 2024 14:33:45 +0000 Subject: [PATCH] Merge r1916129 from trunk (htpasswd docs): Document SHA-2 support. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1916749 13f79535-47bb-0310-9956-ffa450edef68 --- docs/manual/programs/htpasswd.xml | 45 ++++++++++++++++++++++++------- 1 file changed, 35 insertions(+), 10 deletions(-) diff --git a/docs/manual/programs/htpasswd.xml b/docs/manual/programs/htpasswd.xml index f145382ce3d..eed794b4964 100644 --- a/docs/manual/programs/htpasswd.xml +++ b/docs/manual/programs/htpasswd.xml @@ -39,13 +39,6 @@ stores, though. To use a DBM database see dbmmanage or htdbm.

-

htpasswd encrypts passwords using either bcrypt, - a version of MD5 modified for Apache, SHA1, or the system's - crypt() routine. Files - managed by htpasswd may contain a mixture of different encoding - types of passwords; some - user records may have bcrypt or MD5-encrypted passwords while others in the - same file may have passwords encrypted with crypt().

htpasswd hashes passwords using either bcrypt, a version of MD5 modified for Apache, SHA-1, or the system's crypt() routine. SHA-2-based hashes (SHA-256 and @@ -72,9 +65,12 @@ distribution. [ -i ] [ -m | -B | + -2 | + -5 | -d | -s | -p ] + [ -r rounds ] [ -C cost ] [ -D ] [ -v ] passwdfile username

@@ -83,9 +79,12 @@ distribution. [ -c ] [ -m | -B | + -2 | + -5 | -d | -s | -p ] + [ -r rounds ] [ -C cost ] [ -D ] [ -v ] passwdfile username @@ -95,17 +94,23 @@ distribution. [ -i ] [ -m | -B | + -2 | + -5 | -d | -s | -p ] + [ -r rounds ] [ -C cost ] username

htpasswd -nb [ -m | - -B | + -B | + -2 | + -5 | -d | -s | -p ] + [ -r rounds ] [ -C cost ] username password

@@ -138,6 +143,14 @@ distribution.
Use MD5 hashing for passwords. This is the default (since version 2.2.18).
+
-2
+
Use SHA-256 crypt() based hashes for passwords. This is + supported on most Unix platforms.
+ +
-5
+
Use SHA-512 crypt() based hashes for passwords. This is + supported on most Unix platforms.
+
-B
Use bcrypt hashing for passwords. This is currently considered to be very secure.
@@ -147,6 +160,12 @@ distribution. hashing). It sets the computing time used for the bcrypt algorithm (higher is more secure but slower, default: 5, valid: 4 to 17). +
-r
+
This flag is only allowed in combination with -2 + or -5. It sets the number of hash rounds used for the + SHA-2 algorithms (higher is more secure but slower; the default is + 5,000).
+
-d
Use crypt() hashing for passwords. This is not supported by the httpd server on Windows and @@ -253,8 +272,14 @@ distribution. prepending a random salt string, to make dictionary attacks against the passwords more difficult.

-

The SHA and crypt() formats are insecure by today's - standards.

+

The SHA-1 and crypt() formats are insecure by + today's standards.

+ +

The SHA-2-based crypt() formats (SHA-256 and + SHA-512) are supported on most modern Unix systems, and follow the + specification at https://www.akkadia.org/drepper/SHA-crypt.txt.

+
Restrictions -- 2.47.2