mod_sql_passwd
Many FTP sites use SQL databases for storing user accounts, including the
user name and password. And while the mod_sql
module provides
support for some formats for the passwords stored in SQL databases, many
sites have other formats which are not supported by mod_sql
.
These other formats often include MD5 or SHA1 passwords, base64-encoded
or hex-encoded, without the prefix which is required by
mod_sql
's "OpenSSL" SQLAuthType
.
The mod_sql_passwd
module provides support for some of these
other formats. When the mod_sql_passwd
module is enabled,
you can configure SQLAuthTypes
of "MD5", "SHA1", "SHA256", or
"SHA512", as well as the existing types supported by mod_sql
.
This module is contained in the mod_sql_passwd.c
file for
ProFTPD 1.3.x, and is not compiled by default. Installation
instructions are discussed here; a discussion
on usage is also available.
This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org/).
This product includes cryptographic software written by Eric Young (eay@cryptsoft.com).
The most current version of mod_sql_passwd
is distributed with
ProFTPD.
Please contact TJ Saunders <tj at castaglia.org> with any questions, concerns, or suggestions regarding this module.
<VirtualHost>
, <Global>
The SQLPasswordEncoding
directive configures the encoding that
mod_sql_passwd
expects when handling password values retrieved
from a SQL database.
The following encoding values are currently supported:
If no SQLPasswordEncoding
directive is configured,
mod_sql_passwd
will use "hex" by default.
<VirtualHost>
, <Global>
Module: mod_sql_passwd
The SQLPasswordEngine
directive enables or disables the module's
registered SQLAuthType
handlers.
<VirtualHost>
, <Global>
Module: mod_sql_passwd
The SQLPasswordSaltFile
directive configures a file which contains
salt data. This salt will be added to the digest, along with the password
sent by the client. Note that the salt will be used for all users.
Since many editors will automatically add a newline when writing a file,
the mod_sql_passwd
file will automatically trim the last newline
in the salt data, if there is one. This means that if your salt must
end in a newline character, then your SQLPasswordSaltFile
must
contain "salt\n\n".
When using salted passwords, some systems will prepend the salt as a
prefix to the data, and others will append the salt as a suffix. The
optional second parameter to SQLPasswordSaltFile
controls how
this module will use the salt:
SQLPasswordSaltFile /path/to/salt prependtells
mod_sql_passwd
to prepend the salt as a prefix, and:
SQLPasswordSaltFile /path/to/salt appendwill cause the salt to be appended as a sufix. Note that the default behavior is to append the salt as a suffix.
If no SQLPasswordSaltFile
is configured, then no salting is done.
<VirtualHost>
, <Global>
Module: mod_sql_passwd
The SQLPasswordUserSalt
directive configures a per-user
salt that will be added to the digest, along with the password sent by the
client.
If "name" is specified, then the per-user salt data will be the
name of the user logging in. Alternatively, you can configure a
SQLNamedQuery
which returns a single column of a single
row, containing a string to use as the salt data, e.g.:
SQLNamedQuery get-user-salt SELECT "salt FROM user_salts WHERE user_name = '%{0}'" SQLPasswordUserSalt sql:/get-user-salt
When using salted passwords, some systems will prepend the salt as a
prefix to the data, and others will append the salt as a suffix. The
optional second parameter to SQLPasswordUserSalt
controls how
this module will use the salt:
SQLPasswordUserSalt name prependtells
mod_sql_passwd
to prepend the salt as a prefix, and:
SQLPasswordUserSalt name appendwill cause the salt to be appended as a sufix. Note that the default behavior is to append the salt as a suffix.
mod_sql_passwd
module is distributed with ProFTPD. Simply
follow the normal steps for using third-party modules in proftpd. The
mod_sql_passwd
module requires OpenSSL support, so you must
use the --enable-openssl
configuration option.
NOTE: it is important that mod_sql_passwd
appear
after mod_sql
in your --with-modules
configure
option:
./configure --enable-openssl --with-modules=mod_sql:mod_sql_passwd ...To build
mod_sql_passwd
as a DSO module:
./configure --enable-dso --enable-openssl --with-shared=mod_sql_passwdThen follow the usual steps:
make make install
For those with an existing ProFTPD installation, you can use the
prxs
tool to add mod_sql_passwd
, as a DSO module, to
your existing server:
# prxs -c -i -d mod_sql_passwd.c
The following examples demonstrate how the mod_sql_passwd
can
be used.
To configure mod_sql_passwd
to handle MD5 passwords that are
base64-encoded, use:
<IfModule mod_sql_passwd.c> SQLPasswordEngine on SQLPasswordEncoding base64 </IfModule> <IfModule mod_sql.c> ... # Now that mod_sql_passwd is used, we can configure "MD5" as an # SQLAuthType that mod_sql will handle. SQLAuthTypes MD5 </IfModule>
To have mod_sql_passwd
to handle hex-encoded (and in
lowercase) passwords, use:
<IfModule mod_sql_passwd.c> SQLPasswordEngine on SQLPasswordEncoding hex </IfModule>
And if for some reason your database values are stored as hex values in uppercase, you would use:
<IfModule mod_sql_passwd.c> SQLPasswordEngine on SQLPasswordEncoding HEX </IfModule>
To use salted passwords, write the salt to use into a file, and configure
the
mod_sql_passwd
module to use it:
<IfModule mod_sql_passwd.c>
SQLPasswordEngine on
SQLPasswordEncoding hex
SQLPasswordSaltFile /path/to/salt
</IfModule>
Author: $Author: castaglia $
Last Updated: $Date: 2010/02/01 19:30:13 $
© Copyright 2009-2010 TJ Saunders
All Rights Reserved