diff options
Diffstat (limited to '')
| -rw-r--r-- | docs/manual/programs/htpasswd.html.en | 111 |
1 files changed, 75 insertions, 36 deletions
diff --git a/docs/manual/programs/htpasswd.html.en b/docs/manual/programs/htpasswd.html.en index 6a347b2..98689b4 100644 --- a/docs/manual/programs/htpasswd.html.en +++ b/docs/manual/programs/htpasswd.html.en @@ -1,7 +1,7 @@ -<?xml version="1.0" encoding="ISO-8859-1"?> +<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head> -<meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type" /> +<meta content="text/html; charset=UTF-8" http-equiv="Content-Type" /> <!-- XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX This file is generated from xml source: DO NOT EDIT @@ -24,9 +24,9 @@ <a href="http://www.apache.org/">Apache</a> > <a href="http://httpd.apache.org/">HTTP Server</a> > <a href="http://httpd.apache.org/docs/">Documentation</a> > <a href="../">Version 2.4</a> > <a href="./">Programs</a></div><div id="page-content"><div id="preamble"><h1>htpasswd - Manage user files for basic authentication</h1> <div class="toplang"> <p><span>Available Languages: </span><a href="../en/programs/htpasswd.html" title="English"> en </a> | -<a href="../fr/programs/htpasswd.html" hreflang="fr" rel="alternate" title="Français"> fr </a> | +<a href="../fr/programs/htpasswd.html" hreflang="fr" rel="alternate" title="Français"> fr </a> | <a href="../ko/programs/htpasswd.html" hreflang="ko" rel="alternate" title="Korean"> ko </a> | -<a href="../tr/programs/htpasswd.html" hreflang="tr" rel="alternate" title="Türkçe"> tr </a></p> +<a href="../tr/programs/htpasswd.html" hreflang="tr" rel="alternate" title="Türkçe"> tr </a></p> </div> <p><code>htpasswd</code> is used to create and update the flat-files used to @@ -38,17 +38,18 @@ <p>Resources available from the Apache HTTP server can be restricted to just the users listed in the files created by <code>htpasswd</code>. This program can only manage usernames and passwords stored in a flat-file. It - can encrypt and display password information for use in other types of data + can hash and display password information for use in other types of data stores, though. To use a DBM database see <code class="program"><a href="../programs/dbmmanage.html">dbmmanage</a></code> or <code class="program"><a href="../programs/htdbm.html">htdbm</a></code>.</p> - <p><code>htpasswd</code> encrypts passwords using either bcrypt, - a version of MD5 modified for Apache, SHA1, or the system's - <code>crypt()</code> routine. Files - managed by <code>htpasswd</code> may contain a mixture of different encoding - types of passwords; some - user records may have bcrypt or MD5-encrypted passwords while others in the - same file may have passwords encrypted with <code>crypt()</code>.</p> + <p><code>htpasswd</code> hashes passwords using either bcrypt, a + version of MD5 modified for Apache, SHA-1, or the system's + <code>crypt()</code> routine. SHA-2-based hashes (SHA-256 and + SHA-512) are supported for <code>crypt()</code>. Files managed by + <code>htpasswd</code> may contain a mixture of different encoding + types of passwords; some user records may have bcrypt or + MD5-hashed passwords while others in the same file may have + passwords hashed with <code>crypt()</code>.</p> <p>This manual page only lists the command line arguments. For details of the directives necessary to configure user authentication in @@ -71,9 +72,12 @@ distribution.</li><li><a href="#comments_section">Comments</a></li></ul></div> [ -<strong>i</strong> ] [ -<strong>m</strong> | -<strong>B</strong> | + -<strong>2</strong> | + -<strong>5</strong> | -<strong>d</strong> | -<strong>s</strong> | -<strong>p</strong> ] + [ -<strong>r</strong> <var>rounds</var> ] [ -<strong>C</strong> <var>cost</var> ] [ -<strong>D</strong> ] [ -<strong>v</strong> ] <var>passwdfile</var> <var>username</var></code></p> @@ -82,9 +86,12 @@ distribution.</li><li><a href="#comments_section">Comments</a></li></ul></div> [ -<strong>c</strong> ] [ -<strong>m</strong> | -<strong>B</strong> | + -<strong>2</strong> | + -<strong>5</strong> | -<strong>d</strong> | -<strong>s</strong> | -<strong>p</strong> ] + [ -<strong>r</strong> <var>rounds</var> ] [ -<strong>C</strong> <var>cost</var> ] [ -<strong>D</strong> ] [ -<strong>v</strong> ] <var>passwdfile</var> <var>username</var> @@ -94,17 +101,23 @@ distribution.</li><li><a href="#comments_section">Comments</a></li></ul></div> [ -<strong>i</strong> ] [ -<strong>m</strong> | -<strong>B</strong> | + -<strong>2</strong> | + -<strong>5</strong> | -<strong>d</strong> | -<strong>s</strong> | -<strong>p</strong> ] + [ -<strong>r</strong> <var>rounds</var> ] [ -<strong>C</strong> <var>cost</var> ] <var>username</var></code></p> <p><code><strong>htpasswd</strong> -<strong>nb</strong> [ -<strong>m</strong> | - -<strong>B</strong> | + -<strong>B</strong> | + -<strong>2</strong> | + -<strong>5</strong> | -<strong>d</strong> | -<strong>s</strong> | -<strong>p</strong> ] + [ -<strong>r</strong> <var>rounds</var> ] [ -<strong>C</strong> <var>cost</var> ] <var>username</var> <var>password</var></code></p> </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> @@ -134,29 +147,44 @@ distribution.</li><li><a href="#comments_section">Comments</a></li></ul></div> one) is omitted. It cannot be combined with the <code>-c</code> option.</dd> <dt><code>-m</code></dt> - <dd>Use MD5 encryption for passwords. This is the default (since version + <dd>Use MD5 hashing for passwords. This is the default (since version 2.2.18).</dd> + <dt><code>-2</code></dt> + <dd>Use SHA-256 <code>crypt()</code> based hashes for passwords. This is + supported on most Unix platforms.</dd> + + <dt><code>-5</code></dt> + <dd>Use SHA-512 <code>crypt()</code> based hashes for passwords. This is + supported on most Unix platforms.</dd> + <dt><code>-B</code></dt> - <dd>Use bcrypt encryption for passwords. This is currently considered to + <dd>Use bcrypt hashing for passwords. This is currently considered to be very secure.</dd> <dt><code>-C</code></dt> <dd>This flag is only allowed in combination with <code>-B</code> (bcrypt - encryption). It sets the computing time used for the bcrypt algorithm - (higher is more secure but slower, default: 5, valid: 4 to 31).</dd> + hashing). It sets the computing time used for the bcrypt algorithm + (higher is more secure but slower, default: 5, valid: 4 to 17).</dd> + + <dt><code>-r</code></dt> + <dd>This flag is only allowed in combination with <code>-2</code> + or <code>-5</code>. It sets the number of hash rounds used for the + SHA-2 algorithms (higher is more secure but slower; the default is + 5,000).</dd> <dt><code>-d</code></dt> - <dd>Use <code>crypt()</code> encryption for passwords. This is not + <dd>Use <code>crypt()</code> hashing for passwords. This is not supported by the <code class="program"><a href="../programs/httpd.html">httpd</a></code> server on Windows and Netware. This algorithm limits the password length to 8 characters. This algorithm is <strong>insecure</strong> by today's standards. It used to be the default algorithm until version 2.2.17.</dd> <dt><code>-s</code></dt> - <dd>Use SHA encryption for passwords. Facilitates migration from/to Netscape - servers using the LDAP Directory Interchange Format (ldif). - This algorithm is <strong>insecure</strong> by today's standards.</dd> + <dd>Use SHA-1 (160-bit) hashing for passwords. Facilitates migration + from/to Netscape servers using the LDAP Directory Interchange + Format (ldif). This algorithm is <strong>insecure</strong> by + today's standards.</dd> <dt><code>-p</code></dt> <dd>Use plaintext passwords. Though <code>htpasswd</code> will support @@ -183,7 +211,7 @@ distribution.</li><li><a href="#comments_section">Comments</a></li></ul></div> does exist, the password is changed.</dd> <dt><code><var>password</var></code></dt> - <dd>The plaintext password to be encrypted and stored in the file. Only + <dd>The plaintext password to be hashed and stored in the file. Only used with the <code>-b</code> flag.</dd> </dl> </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> @@ -208,7 +236,7 @@ distribution.</li><li><a href="#comments_section">Comments</a></li></ul></div> </code></p></div> <p>Adds or modifies the password for user <code>jsmith</code>. The user - is prompted for the password. The password will be encrypted using the + is prompted for the password. The password will be hashed using the modified Apache MD5 algorithm. If the file does not exist, <code>htpasswd</code> will do nothing except return an error.</p> @@ -239,40 +267,51 @@ distribution.</li><li><a href="#comments_section">Comments</a></li></ul></div> setuid.</p> <p>The use of the <code>-b</code> option is discouraged, since when it is - used the unencrypted password appears on the command line.</p> + used the plaintext password appears on the command line.</p> <p>When using the <code>crypt()</code> algorithm, note that only the first 8 characters of the password are used to form the password. If the supplied password is longer, the extra characters will be silently discarded.</p> - <p>The SHA encryption format does not use salting: for a given password, - there is only one encrypted representation. The <code>crypt()</code> and - MD5 formats permute the representation by prepending a random salt string, - to make dictionary attacks against the passwords more difficult.</p> + <p>The SHA-1 hashing format does not use salting: for a given + password, there is only one hashed representation. The + <code>crypt()</code> and MD5 formats permute the representation by + prepending a random salt string, to make dictionary attacks + against the passwords more difficult.</p> + + <p>The SHA-1 and <code>crypt()</code> formats are insecure by + today's standards.</p> - <p>The SHA and <code>crypt()</code> formats are insecure by today's - standards.</p> + <p>The SHA-2-based <code>crypt()</code> formats (SHA-256 and + SHA-512) are supported on most modern Unix systems, and follow the + specification at <a href="https://www.akkadia.org/drepper/SHA-crypt.txt">https://www.akkadia.org/drepper/SHA-crypt.txt</a>.</p> + </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> <div class="section"> <h2><a name="restrictions" id="restrictions">Restrictions</a></h2> - <p>On the Windows platform, passwords encrypted with + <p>On the Windows platform, passwords hashed with <code>htpasswd</code> are limited to no more than <code>255</code> characters in length. Longer passwords will be truncated to 255 characters.</p> <p>The MD5 algorithm used by <code>htpasswd</code> is specific to the Apache - software; passwords encrypted using it will not be usable with other Web + software; passwords hashed using it will not be usable with other Web servers.</p> <p>Usernames are limited to <code>255</code> bytes and may not include the character <code>:</code>.</p> + + <p>The cost of computing a bcrypt password hash value increases + with the number of rounds specified by the <code>-C</code> option. + The <code>apr-util</code> library enforces a maximum number of + rounds of 17 in version <code>1.6.0</code> and later.</p> </div></div> <div class="bottomlang"> <p><span>Available Languages: </span><a href="../en/programs/htpasswd.html" title="English"> en </a> | -<a href="../fr/programs/htpasswd.html" hreflang="fr" rel="alternate" title="Français"> fr </a> | +<a href="../fr/programs/htpasswd.html" hreflang="fr" rel="alternate" title="Français"> fr </a> | <a href="../ko/programs/htpasswd.html" hreflang="ko" rel="alternate" title="Korean"> ko </a> | -<a href="../tr/programs/htpasswd.html" hreflang="tr" rel="alternate" title="Türkçe"> tr </a></p> -</div><div class="top"><a href="#page-header"><img src="../images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div> +<a href="../tr/programs/htpasswd.html" hreflang="tr" rel="alternate" title="Türkçe"> tr </a></p> +</div><div class="top"><a href="#page-header"><img src="../images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Libera.chat, or sent to our <a href="https://httpd.apache.org/lists.html">mailing lists</a>.</div> <script type="text/javascript"><!--//--><![CDATA[//><!-- var comments_shortname = 'httpd'; var comments_identifier = 'http://httpd.apache.org/docs/2.4/programs/htpasswd.html'; @@ -290,7 +329,7 @@ var comments_identifier = 'http://httpd.apache.org/docs/2.4/programs/htpasswd.ht } })(window, document); //--><!]]></script></div><div id="footer"> -<p class="apache">Copyright 2019 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p> +<p class="apache">Copyright 2024 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p> <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!-- if (typeof(prettyPrint) !== 'undefined') { prettyPrint(); |