Diff options
Diffstat (limited to 'custom/extensions/auth-inline.lua')
| -rw-r--r-- | custom/extensions/auth-inline.lua | 15 |
1 file changed, 13 insertions, 2 deletions
diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua index 3355b5c..f6a0521 100644 --- a/custom/extensions/auth-inline.lua +++ b/custom/extensions/auth-inline.lua @@ -61,8 +61,19 @@ local protected_repos = { -- ["another"] = { alice = true }, } --- Accounts as name and hash. Generate a hash with --- mkpasswd -m sha-512 -R 300000 +-- Accounts as name and hash, where the hash is any kind this system's crypt(3) +-- checks. yescrypt ($y$) is what libxcrypt recommends, as on Debian, Ubuntu and +-- Fedora, though musl, as on Alpine, does not check it. SHA-512 ($6$) works on +-- Linux and FreeBSD given enough rounds, bcrypt ($2b$) is the only kind OpenBSD +-- checks, and macOS checks none of them. Make one with whichever of these the +-- system has. +-- +-- # Debian and Ubuntu, from the whois package +-- mkpasswd -m yescrypt +-- # anywhere with OpenSSL, as SHA-512 +-- openssl passwd -6 -salt "rounds=300000\$$(openssl rand -hex 8)" +-- # OpenBSD, as bcrypt +-- encrypt -b a -p local users = { -- alice = "$6$rounds=300000$REPLACE_THIS_SALT$REPLACE_THIS_HASH", -- bob = "$6$rounds=300000$REPLACE_THIS_SALT$REPLACE_THIS_HASH", |