Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Say which hash kinds each system's crypt checks
The one recipe given, SHA-512 from Debian's mkpasswd, cannot log anyone
in on OpenBSD, whose crypt checks only bcrypt, or on macOS, and
libxcrypt, which most Linux distributions use, recommends yescrypt
instead.
| -rw-r--r-- | custom/extensions/auth-file.lua | 16 | |
| -rw-r--r-- | custom/extensions/auth-inline.lua | 15 |
2 files changed, 27 insertions, 4 deletions
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua index 59e05cc..18a80fd 100644 --- a/custom/extensions/auth-file.lua +++ b/custom/extensions/auth-file.lua @@ -52,8 +52,20 @@ local hmac = require("openssl.hmac") -- The values that follow are the configuration and are meant to be edited. --- Accounts live one per line as username:hash. Generate a hash with --- mkpasswd -m sha-512 -R 300000 +-- Accounts live one per line as username:hash, where the hash is any kind this +-- system's crypt(3) checks. yescrypt ($y$) is what libxcrypt recommends, as on +-- Debian, Ubuntu and Fedora, though musl, as on Alpine, does not check it. +-- SHA-512 ($6$) works on Linux and FreeBSD given enough rounds, bcrypt ($2b$) +-- is the only kind OpenBSD checks, and macOS checks none of them. Make one +-- with whichever of these the system has. +-- +-- # Debian and Ubuntu, from the whois package +-- mkpasswd -m yescrypt +-- # anywhere with OpenSSL, as SHA-512 +-- openssl passwd -6 -salt "rounds=300000\$$(openssl rand -hex 8)" +-- # OpenBSD, as bcrypt +-- encrypt -b a -p +-- -- This file should not be world-readable. local users_filename = "/etc/cgit-auth/users" diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua index 3355b5c..f6a0521 100644 --- a/custom/extensions/auth-inline.lua +++ b/custom/extensions/auth-inline.lua @@ -61,8 +61,19 @@ local protected_repos = { -- ["another"] = { alice = true }, } --- Accounts as name and hash. Generate a hash with --- mkpasswd -m sha-512 -R 300000 +-- Accounts as name and hash, where the hash is any kind this system's crypt(3) +-- checks. yescrypt ($y$) is what libxcrypt recommends, as on Debian, Ubuntu and +-- Fedora, though musl, as on Alpine, does not check it. SHA-512 ($6$) works on +-- Linux and FreeBSD given enough rounds, bcrypt ($2b$) is the only kind OpenBSD +-- checks, and macOS checks none of them. Make one with whichever of these the +-- system has. +-- +-- # Debian and Ubuntu, from the whois package +-- mkpasswd -m yescrypt +-- # anywhere with OpenSSL, as SHA-512 +-- openssl passwd -6 -salt "rounds=300000\$$(openssl rand -hex 8)" +-- # OpenBSD, as bcrypt +-- encrypt -b a -p local users = { -- alice = "$6$rounds=300000$REPLACE_THIS_SALT$REPLACE_THIS_HASH", -- bob = "$6$rounds=300000$REPLACE_THIS_SALT$REPLACE_THIS_HASH", |