I'm using mod_auth_mysql
with Apache 2 and MySQL 5 for apache authorization. Right now our passwords are being stored in the plain in our database. As a new requirement, we have to store them with a salt, to fight rainbow table attacks. The documentation states:
AuthMySQLSaltField <> | <string> | mysql_column_name
Contains information on the salt field to be used for crypt and aes
encryption methods. It can contain one of the following:
<>: password itself is the salt field (use with crypt() only)
<string>: "string" as the salt field
mysql_column_name: the salt is take from the mysql_column_name field in the
same row as the password
This field is required for aes encryption, optional for crypt encryption.
It is ignored for all other encryption types.
So it looks like the module can do it, but I can't find anything on how to do this? What should I put in the password column? What should I put in the salt? How do I use AES? (Most of the applications will be PHP for creating users)