From b2e90cf8872d1601f8fa35ef520bbf8a5077c632 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Fri, 16 Oct 2026 22:12:31 -1000 Subject: Say which hash kinds each system's crypt checks The one recipe given, SHA-512 from Debian's mkpasswd, cannot log anyone in on OpenBSD, whose crypt checks only bcrypt, or on macOS, and libxcrypt, which most Linux distributions use, recommends yescrypt instead. --- custom/extensions/auth-inline.lua | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) (limited to 'custom/extensions/auth-inline.lua') diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua index 3355b5c..f6a0521 100644 --- a/custom/extensions/auth-inline.lua +++ b/custom/extensions/auth-inline.lua @@ -61,8 +61,19 @@ local protected_repos = { -- ["another"] = { alice = true }, } --- Accounts as name and hash. Generate a hash with --- mkpasswd -m sha-512 -R 300000 +-- Accounts as name and hash, where the hash is any kind this system's crypt(3) +-- checks. yescrypt ($y$) is what libxcrypt recommends, as on Debian, Ubuntu and +-- Fedora, though musl, as on Alpine, does not check it. SHA-512 ($6$) works on +-- Linux and FreeBSD given enough rounds, bcrypt ($2b$) is the only kind OpenBSD +-- checks, and macOS checks none of them. Make one with whichever of these the +-- system has. +-- +-- # Debian and Ubuntu, from the whois package +-- mkpasswd -m yescrypt +-- # anywhere with OpenSSL, as SHA-512 +-- openssl passwd -6 -salt "rounds=300000\$$(openssl rand -hex 8)" +-- # OpenBSD, as bcrypt +-- encrypt -b a -p local users = { -- alice = "$6$rounds=300000$REPLACE_THIS_SALT$REPLACE_THIS_HASH", -- bob = "$6$rounds=300000$REPLACE_THIS_SALT$REPLACE_THIS_HASH", -- cgit