2

I'm using mod_auth_mysql with Apache 2 and MySQL 5 for apache authorization. Right now our passwords are being stored in the plain in our database. As a new requirement, we have to store them with a salt, to fight rainbow table attacks. The documentation states:

AuthMySQLSaltField <> | <string> | mysql_column_name

 Contains information on the salt field to be used for crypt and aes
 encryption methods.  It can contain one of the following:
   <>: password itself is the salt field (use with crypt() only)
   <string>: "string" as the salt field
   mysql_column_name: the salt is take from the mysql_column_name field in the
     same row as the password

 This field is required for aes encryption, optional for crypt encryption.
 It is ignored for all other encryption types.

So it looks like the module can do it, but I can't find anything on how to do this? What should I put in the password column? What should I put in the salt? How do I use AES? (Most of the applications will be PHP for creating users)

2 Answers 2

1

That depends on what your salt is!

Generally, you might use something that the user can't change, like their ID, as a salt; if that is the case, specify the column that contains the user ID.

If you are using a constant salt, then enclose it in <> marks.

2
  • I wouldn't use a username for a salt, not to start any crypto wars, but if you can just use another random string stored in another column, there's no reason for not so random/possibly malicious user input to be in there.
    – reconbot
    Aug 10, 2009 at 18:20
  • I meant a numeric ID - MediaWiki, for example, stores the password as the hash of '#-password', where # is your user ID. See xoa.petdance.com/How_to:_Reset_a_MediaWiki_password
    – crb
    Aug 10, 2009 at 19:26
0

The salt should be a random string not a md5/sha1/256. The docs you presented are looking for the salt to be in it's own column. So you "need" 3 Columns for auth uses

Usersname/email = user submitted
passwordhash = hash(password, passwordsalt)
passwordsalt = random string

You can easily use these columns to verify passwords and create new user records with salt and hash.

Don't ever store plain text passwords.

As for the hash() function, take a look at the phpass library. It's what wordpress turned to when they finally implimented salted hashes in their database.

2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .