diff options
Diffstat (limited to 'docs/manual/programs/htpasswd.html.en')
| -rw-r--r-- | docs/manual/programs/htpasswd.html.en | 90 |
1 files changed, 62 insertions, 28 deletions
diff --git a/docs/manual/programs/htpasswd.html.en b/docs/manual/programs/htpasswd.html.en index 9c219e1..98689b4 100644 --- a/docs/manual/programs/htpasswd.html.en +++ b/docs/manual/programs/htpasswd.html.en @@ -38,17 +38,18 @@ <p>Resources available from the Apache HTTP server can be restricted to just the users listed in the files created by <code>htpasswd</code>. This program can only manage usernames and passwords stored in a flat-file. It - can encrypt and display password information for use in other types of data + can hash and display password information for use in other types of data stores, though. To use a DBM database see <code class="program"><a href="../programs/dbmmanage.html">dbmmanage</a></code> or <code class="program"><a href="../programs/htdbm.html">htdbm</a></code>.</p> - <p><code>htpasswd</code> encrypts passwords using either bcrypt, - a version of MD5 modified for Apache, SHA1, or the system's - <code>crypt()</code> routine. Files - managed by <code>htpasswd</code> may contain a mixture of different encoding - types of passwords; some - user records may have bcrypt or MD5-encrypted passwords while others in the - same file may have passwords encrypted with <code>crypt()</code>.</p> + <p><code>htpasswd</code> hashes passwords using either bcrypt, a + version of MD5 modified for Apache, SHA-1, or the system's + <code>crypt()</code> routine. SHA-2-based hashes (SHA-256 and + SHA-512) are supported for <code>crypt()</code>. Files managed by + <code>htpasswd</code> may contain a mixture of different encoding + types of passwords; some user records may have bcrypt or + MD5-hashed passwords while others in the same file may have + passwords hashed with <code>crypt()</code>.</p> <p>This manual page only lists the command line arguments. For details of the directives necessary to configure user authentication in @@ -71,9 +72,12 @@ distribution.</li><li><a href="#comments_section">Comments</a></li></ul></div> [ -<strong>i</strong> ] [ -<strong>m</strong> | -<strong>B</strong> | + -<strong>2</strong> | + -<strong>5</strong> | -<strong>d</strong> | -<strong>s</strong> | -<strong>p</strong> ] + [ -<strong>r</strong> <var>rounds</var> ] [ -<strong>C</strong> <var>cost</var> ] [ -<strong>D</strong> ] [ -<strong>v</strong> ] <var>passwdfile</var> <var>username</var></code></p> @@ -82,9 +86,12 @@ distribution.</li><li><a href="#comments_section">Comments</a></li></ul></div> [ -<strong>c</strong> ] [ -<strong>m</strong> | -<strong>B</strong> | + -<strong>2</strong> | + -<strong>5</strong> | -<strong>d</strong> | -<strong>s</strong> | -<strong>p</strong> ] + [ -<strong>r</strong> <var>rounds</var> ] [ -<strong>C</strong> <var>cost</var> ] [ -<strong>D</strong> ] [ -<strong>v</strong> ] <var>passwdfile</var> <var>username</var> @@ -94,17 +101,23 @@ distribution.</li><li><a href="#comments_section">Comments</a></li></ul></div> [ -<strong>i</strong> ] [ -<strong>m</strong> | -<strong>B</strong> | + -<strong>2</strong> | + -<strong>5</strong> | -<strong>d</strong> | -<strong>s</strong> | -<strong>p</strong> ] + [ -<strong>r</strong> <var>rounds</var> ] [ -<strong>C</strong> <var>cost</var> ] <var>username</var></code></p> <p><code><strong>htpasswd</strong> -<strong>nb</strong> [ -<strong>m</strong> | - -<strong>B</strong> | + -<strong>B</strong> | + -<strong>2</strong> | + -<strong>5</strong> | -<strong>d</strong> | -<strong>s</strong> | -<strong>p</strong> ] + [ -<strong>r</strong> <var>rounds</var> ] [ -<strong>C</strong> <var>cost</var> ] <var>username</var> <var>password</var></code></p> </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> @@ -134,29 +147,44 @@ distribution.</li><li><a href="#comments_section">Comments</a></li></ul></div> one) is omitted. It cannot be combined with the <code>-c</code> option.</dd> <dt><code>-m</code></dt> - <dd>Use MD5 encryption for passwords. This is the default (since version + <dd>Use MD5 hashing for passwords. This is the default (since version 2.2.18).</dd> + <dt><code>-2</code></dt> + <dd>Use SHA-256 <code>crypt()</code> based hashes for passwords. This is + supported on most Unix platforms.</dd> + + <dt><code>-5</code></dt> + <dd>Use SHA-512 <code>crypt()</code> based hashes for passwords. This is + supported on most Unix platforms.</dd> + <dt><code>-B</code></dt> - <dd>Use bcrypt encryption for passwords. This is currently considered to + <dd>Use bcrypt hashing for passwords. This is currently considered to be very secure.</dd> <dt><code>-C</code></dt> <dd>This flag is only allowed in combination with <code>-B</code> (bcrypt - encryption). It sets the computing time used for the bcrypt algorithm + hashing). It sets the computing time used for the bcrypt algorithm (higher is more secure but slower, default: 5, valid: 4 to 17).</dd> + <dt><code>-r</code></dt> + <dd>This flag is only allowed in combination with <code>-2</code> + or <code>-5</code>. It sets the number of hash rounds used for the + SHA-2 algorithms (higher is more secure but slower; the default is + 5,000).</dd> + <dt><code>-d</code></dt> - <dd>Use <code>crypt()</code> encryption for passwords. This is not + <dd>Use <code>crypt()</code> hashing for passwords. This is not supported by the <code class="program"><a href="../programs/httpd.html">httpd</a></code> server on Windows and Netware. This algorithm limits the password length to 8 characters. This algorithm is <strong>insecure</strong> by today's standards. It used to be the default algorithm until version 2.2.17.</dd> <dt><code>-s</code></dt> - <dd>Use SHA encryption for passwords. Facilitates migration from/to Netscape - servers using the LDAP Directory Interchange Format (ldif). - This algorithm is <strong>insecure</strong> by today's standards.</dd> + <dd>Use SHA-1 (160-bit) hashing for passwords. Facilitates migration + from/to Netscape servers using the LDAP Directory Interchange + Format (ldif). This algorithm is <strong>insecure</strong> by + today's standards.</dd> <dt><code>-p</code></dt> <dd>Use plaintext passwords. Though <code>htpasswd</code> will support @@ -183,7 +211,7 @@ distribution.</li><li><a href="#comments_section">Comments</a></li></ul></div> does exist, the password is changed.</dd> <dt><code><var>password</var></code></dt> - <dd>The plaintext password to be encrypted and stored in the file. Only + <dd>The plaintext password to be hashed and stored in the file. Only used with the <code>-b</code> flag.</dd> </dl> </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> @@ -208,7 +236,7 @@ distribution.</li><li><a href="#comments_section">Comments</a></li></ul></div> </code></p></div> <p>Adds or modifies the password for user <code>jsmith</code>. The user - is prompted for the password. The password will be encrypted using the + is prompted for the password. The password will be hashed using the modified Apache MD5 algorithm. If the file does not exist, <code>htpasswd</code> will do nothing except return an error.</p> @@ -239,29 +267,35 @@ distribution.</li><li><a href="#comments_section">Comments</a></li></ul></div> setuid.</p> <p>The use of the <code>-b</code> option is discouraged, since when it is - used the unencrypted password appears on the command line.</p> + used the plaintext password appears on the command line.</p> <p>When using the <code>crypt()</code> algorithm, note that only the first 8 characters of the password are used to form the password. If the supplied password is longer, the extra characters will be silently discarded.</p> - <p>The SHA encryption format does not use salting: for a given password, - there is only one encrypted representation. The <code>crypt()</code> and - MD5 formats permute the representation by prepending a random salt string, - to make dictionary attacks against the passwords more difficult.</p> + <p>The SHA-1 hashing format does not use salting: for a given + password, there is only one hashed representation. The + <code>crypt()</code> and MD5 formats permute the representation by + prepending a random salt string, to make dictionary attacks + against the passwords more difficult.</p> + + <p>The SHA-1 and <code>crypt()</code> formats are insecure by + today's standards.</p> - <p>The SHA and <code>crypt()</code> formats are insecure by today's - standards.</p> + <p>The SHA-2-based <code>crypt()</code> formats (SHA-256 and + SHA-512) are supported on most modern Unix systems, and follow the + specification at <a href="https://www.akkadia.org/drepper/SHA-crypt.txt">https://www.akkadia.org/drepper/SHA-crypt.txt</a>.</p> + </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> <div class="section"> <h2><a name="restrictions" id="restrictions">Restrictions</a></h2> - <p>On the Windows platform, passwords encrypted with + <p>On the Windows platform, passwords hashed with <code>htpasswd</code> are limited to no more than <code>255</code> characters in length. Longer passwords will be truncated to 255 characters.</p> <p>The MD5 algorithm used by <code>htpasswd</code> is specific to the Apache - software; passwords encrypted using it will not be usable with other Web + software; passwords hashed using it will not be usable with other Web servers.</p> <p>Usernames are limited to <code>255</code> bytes and may not include the @@ -295,7 +329,7 @@ var comments_identifier = 'http://httpd.apache.org/docs/2.4/programs/htpasswd.ht } })(window, document); //--><!]]></script></div><div id="footer"> -<p class="apache">Copyright 2023 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p> +<p class="apache">Copyright 2024 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p> <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!-- if (typeof(prettyPrint) !== 'undefined') { prettyPrint(); |