Freeside:3:Documentation:Administration:svc acct: password encoding

Introduction

The svc_acct._password_encoding field specifies the encoding of the corresponding svc_acct._password field. Password encodings specify a format for storing a password along with information about its hash method (crypt/MD5/blowfish/etc.), if any. Password encodings do not represent a single, specific hash method each; instead, they tell you how the hash method and encrypted string are stored.

This functionality is new in 1.9.

Encodings

crypt

Typically used when importing hashed passwords from an /etc/shadow file or a system that uses the same encoding.

Common crypt encodings:

• Classic DES crypt: exactly 13 base-64 encoded characters, like from an old /etc/passwd or /etc/shadow file
• MD5: $1$ followed by 22 base-64 encoded characters, like from a more modern /etc/shadow file.
• Blowfish: $2$ or $2a$ followed by base-64 encoded characters, like from a /etc/shadow file on a blowfish-capable system.

ldap

Typically used when importing hashed passwords from an LDAP database or a system that uses the same encoding.

Common LDAP encodings.

• Plaintext: {PLAIN} followed by the plaintext password (also: {CLEARTEXT}).
• Crypt: {CRYPT} followed by a crypt string as per above (but usually only classic DES crypt).
• MD5: {MD5} followed by the MD5 digest.
• SHA1: {SHA} followed by the SHA-1 digest.

plain

• Password is explicitly plaintext, with no encoding, and can be any length.

NULL/empty

If svc_acct._password_encoding is NULL or empty, legacy (1.7) encoding is assumed:

• *, ! or !! means that no login is allowed.
• Anything else under 13 characters is a plaintext password
• Exactly 13 characters is DES crypted
• Starting with $1$ is MD5
• Starting with $2$ or $2a$ is Blowfish (support incomplete; if self-service login is required, store Blowfish passwords with "crypt" encoding instead).
• Anything else unrecognized.

See also

• Freeside uses Authen::Passphrase for password handling, and many details in this documentation are lifted from there. See the Authen::Passphrase docuementation.
• RFC 2307