Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How do I enable crypt_blowfish support for shadowed passwords and PHP on a Linux (Debian) server?

I'm referring to the OpenBSD-style Blowfish-based bcrypt, known in PHP as CRYPT_BLOWFISH.

As far as I know there is no Debian package for it, what other options do I have to enable this hashing algorithm for PHP?

Note:
PHP's crypt() fuction interfaces relatively directly with the C-library crypt(3) function provided by the underlying operating system.

Update
Package-naming is not as clear as it could (should) be.
The PEAR Crypt_Blowfish package is a drop-in replacement for PHP's MCrypt extension, allowing for quick two-way blowfish encryption.

Also the Debian BCrypt package is also an implementation of the 'normal' two-way blowfish algorithm.

What I'm looking for is the Bcrypt-hash implementation for hashing passwords.

share|improve this question
    
doesn't "pear install Crypt_blowfish" work? –  cori May 20 '09 at 23:02
    
The pear crypt_blowfish package is the 'normal' two-way blowfish encryption algorithm. I'm looking for the blowfish-based hashing algorithm. –  Jacco May 21 '09 at 10:34
    
ah, now I see the problem. –  cori May 21 '09 at 17:25
    
Didn't know you could have a higher bounty on a question then your current rep. Interesting. –  Copas May 23 '09 at 20:49
    
Rep is deducted immediately, so he had ~200 rep and now has ~50. –  ceejayoz May 24 '09 at 3:51
show 1 more comment

1 Answer

up vote 7 down vote accepted
+150

The package you need to install in debian is libpam-unix2.

Then you will have to edit the following files under /etc/pam.d/, and change all pam_unix.so usage to pam_unix2.so

  • common-account
  • common-auth
  • common-password
  • common-session

Finally, edit common-password file and replace "md5" parameter with "blowfish".

Passwords that are updated after these modifications are made will be hased using blowfish, exising shadow passwords are not modified. Source

To use blowfish in PHP, you provide a blowfish salt to crypt(). Like this;

crypt('sting', '$2a$07$' . substr('saltsaltsalt', 0, CRYPT_SALT_LENGTH) )

You should first check if CRYPT_BLOWFISH==1. And you'll need to use a long enough salt, which is equal to (or greater than) 22 characters. Source

share|improve this answer
    
Hmmm, after making those changes, CRYPT_BLOWFISH still doesn't equal 1, for some reason. –  Kzqai Aug 5 '11 at 15:57
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.