Say which hash kinds each system's crypt checks

The one recipe given, SHA-512 from Debian's mkpasswd, cannot log anyone
in on OpenBSD, whose crypt checks only bcrypt, or on macOS, and
libxcrypt, which most Linux distributions use, recommends yescrypt
instead.

2 files changed, 27 insertions, 4 deletions

diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.luaindex 59e05cc..18a80fd 100644--- a/custom/extensions/auth-file.lua+++ b/custom/extensions/auth-file.lua@@ -52,8 +52,20 @@ local hmac = require("openssl.hmac")  -- The values that follow are the configuration and are meant to be edited. --- Accounts live one per line as username:hash. Generate a hash with---     mkpasswd -m sha-512 -R 300000+-- Accounts live one per line as username:hash, where the hash is any kind this+-- system's crypt(3) checks. yescrypt ($y$) is what libxcrypt recommends, as on+-- Debian, Ubuntu and Fedora, though musl, as on Alpine, does not check it.+-- SHA-512 ($6$) works on Linux and FreeBSD given enough rounds, bcrypt ($2b$)+-- is the only kind OpenBSD checks, and macOS checks none of them. Make one+-- with whichever of these the system has.+--+--     # Debian and Ubuntu, from the whois package+--     mkpasswd -m yescrypt+--     # anywhere with OpenSSL, as SHA-512+--     openssl passwd -6 -salt "rounds=300000\$$(openssl rand -hex 8)"+--     # OpenBSD, as bcrypt+--     encrypt -b a -p+-- -- This file should not be world-readable. local users_filename = "/etc/cgit-auth/users" 
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua
index 59e05cc..18a80fd 100644
--- a/custom/extensions/auth-file.lua
+++ b/custom/extensions/auth-file.lua
@@ -52,8 +52,20 @@ local hmac = require("openssl.hmac")
 
 -- The values that follow are the configuration and are meant to be edited.
 
--- Accounts live one per line as username:hash. Generate a hash with
---     mkpasswd -m sha-512 -R 300000
+-- Accounts live one per line as username:hash, where the hash is any kind this
+-- system's crypt(3) checks. yescrypt ($y$) is what libxcrypt recommends, as on
+-- Debian, Ubuntu and Fedora, though musl, as on Alpine, does not check it.
+-- SHA-512 ($6$) works on Linux and FreeBSD given enough rounds, bcrypt ($2b$)
+-- is the only kind OpenBSD checks, and macOS checks none of them. Make one
+-- with whichever of these the system has.
+--
+--     # Debian and Ubuntu, from the whois package
+--     mkpasswd -m yescrypt
+--     # anywhere with OpenSSL, as SHA-512
+--     openssl passwd -6 -salt "rounds=300000\$$(openssl rand -hex 8)"
+--     # OpenBSD, as bcrypt
+--     encrypt -b a -p
+--
 -- This file should not be world-readable.
 local users_filename = "/etc/cgit-auth/users"
 
diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.luaindex 3355b5c..f6a0521 100644--- a/custom/extensions/auth-inline.lua+++ b/custom/extensions/auth-inline.lua@@ -61,8 +61,19 @@ local protected_repos = { 	-- ["another"]     = { alice = true }, } --- Accounts as name and hash. Generate a hash with---     mkpasswd -m sha-512 -R 300000+-- Accounts as name and hash, where the hash is any kind this system's crypt(3)+-- checks. yescrypt ($y$) is what libxcrypt recommends, as on Debian, Ubuntu and+-- Fedora, though musl, as on Alpine, does not check it. SHA-512 ($6$) works on+-- Linux and FreeBSD given enough rounds, bcrypt ($2b$) is the only kind OpenBSD+-- checks, and macOS checks none of them. Make one with whichever of these the+-- system has.+--+--     # Debian and Ubuntu, from the whois package+--     mkpasswd -m yescrypt+--     # anywhere with OpenSSL, as SHA-512+--     openssl passwd -6 -salt "rounds=300000\$$(openssl rand -hex 8)"+--     # OpenBSD, as bcrypt+--     encrypt -b a -p local users = { 	-- alice = "$6$rounds=300000$REPLACE_THIS_SALT$REPLACE_THIS_HASH", 	-- bob   = "$6$rounds=300000$REPLACE_THIS_SALT$REPLACE_THIS_HASH",
diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua
index 3355b5c..f6a0521 100644
--- a/custom/extensions/auth-inline.lua
+++ b/custom/extensions/auth-inline.lua
@@ -61,8 +61,19 @@ local protected_repos = {
 	-- ["another"]     = { alice = true },
 }
 
--- Accounts as name and hash. Generate a hash with
---     mkpasswd -m sha-512 -R 300000
+-- Accounts as name and hash, where the hash is any kind this system's crypt(3)
+-- checks. yescrypt ($y$) is what libxcrypt recommends, as on Debian, Ubuntu and
+-- Fedora, though musl, as on Alpine, does not check it. SHA-512 ($6$) works on
+-- Linux and FreeBSD given enough rounds, bcrypt ($2b$) is the only kind OpenBSD
+-- checks, and macOS checks none of them. Make one with whichever of these the
+-- system has.
+--
+--     # Debian and Ubuntu, from the whois package
+--     mkpasswd -m yescrypt
+--     # anywhere with OpenSSL, as SHA-512
+--     openssl passwd -6 -salt "rounds=300000\$$(openssl rand -hex 8)"
+--     # OpenBSD, as bcrypt
+--     encrypt -b a -p
 local users = {
 	-- alice = "$6$rounds=300000$REPLACE_THIS_SALT$REPLACE_THIS_HASH",
 	-- bob   = "$6$rounds=300000$REPLACE_THIS_SALT$REPLACE_THIS_HASH",