From b2e90cf8872d1601f8fa35ef520bbf8a5077c632 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Fri, 16 Oct 2026 22:12:31 -1000 Subject: Say which hash kinds each system's crypt checks The one recipe given, SHA-512 from Debian's mkpasswd, cannot log anyone in on OpenBSD, whose crypt checks only bcrypt, or on macOS, and libxcrypt, which most Linux distributions use, recommends yescrypt instead. --- custom/extensions/auth-file.lua | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) (limited to 'custom/extensions/auth-file.lua') diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua index 59e05cc..18a80fd 100644 --- a/custom/extensions/auth-file.lua +++ b/custom/extensions/auth-file.lua @@ -52,8 +52,20 @@ local hmac = require("openssl.hmac") -- The values that follow are the configuration and are meant to be edited. --- Accounts live one per line as username:hash. Generate a hash with --- mkpasswd -m sha-512 -R 300000 +-- Accounts live one per line as username:hash, where the hash is any kind this +-- system's crypt(3) checks. yescrypt ($y$) is what libxcrypt recommends, as on +-- Debian, Ubuntu and Fedora, though musl, as on Alpine, does not check it. +-- SHA-512 ($6$) works on Linux and FreeBSD given enough rounds, bcrypt ($2b$) +-- is the only kind OpenBSD checks, and macOS checks none of them. Make one +-- with whichever of these the system has. +-- +-- # Debian and Ubuntu, from the whois package +-- mkpasswd -m yescrypt +-- # anywhere with OpenSSL, as SHA-512 +-- openssl passwd -6 -salt "rounds=300000\$$(openssl rand -hex 8)" +-- # OpenBSD, as bcrypt +-- encrypt -b a -p +-- -- This file should not be world-readable. local users_filename = "/etc/cgit-auth/users" -- cgit