Basic auth not working 100%

AMP_Admin · April 7, 2010, 5:34pm

On one of my boxes I noticed that if the password is only half the
string it
will authenticate.

Should be:

Username: tester

Pass: ThisPassword1234#&^

But the following authenticates:

Username: tester

Pass: ThisPassword

Can anyone confirm this behavior?

AMP_Admin · April 7, 2010, 6:08pm

On Wed, Apr 7, 2010 at 7:33 PM, AMP Admin [email protected] wrote:

On one of my boxes I noticed that if the password is only half the string it
will authenticate.
Should be:
Username: tester
Pass: ThisPassword1234#&^
But the following authenticates:
Username: tester
Pass: ThisPassword
Can anyone confirm this behavior?

ThisPass will also authenticate - crypt() uses only first 8 symbols of
the password.

–
Boris D…

AMP_Admin · April 8, 2010, 4:52pm

Yeps that’s a shortcoming of crypt(). One way to go around it is to use
a 8
char password, but a pretty random string (the “password”) as the
username

Ray.

AMP_Admin · April 11, 2010, 11:52am

On Sat, Apr 10, 2010 at 10:33 PM, AMP Admin [email protected] wrote:

is there a way to make it longer?

bcrypt ($2a$…) passwords can be used - on FreeBSD, at least.

–
O< ascii ribbon campaign - stop html mail - www.asciiribbon.org