Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does anyone know of (simple) way to use PBKDF2 or BCrypt as a password hash within Apache HTTPD.

The general scenario is that I have a resource in /private that I would like to restrict to a given group of users. Those users will have passwords stored in a database and verified using a mod_auth_dbd.

I would like to get away from using SSHA.

I can see in the Apache apr-util that there is a function apr_password_validate (which handles all the now frowned upon hash types); and in apr_crypto_openssl.c there is crypto_passphrase which is an implementation of PBKDF2.

Has anyone welded the two together? (or have I just missed something obvious somewhere in the Apache docs?)

share|improve this question
up vote 1 down vote accepted

So after further review, it seems that everything was a lot simpler than I'd imagined.

HTTPD uses the system provided crypt function, and so leverages its modularity.

In theory it supports BCrypt directly (although I did not test it). I did test SHA-512 using the $6 prefix.

So setting a password as calculated below achieves the desired result:

salt = 'fGn9LR75';
puts 'quohjo5oor4ac3Deolei'.crypt('$6$' + salt);
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.