Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm using mod_auth_mysql with Apache 2 and MySQL 5 for apache authorization. Right now our passwords are being stored in the plain in our database. As a new requirement, we have to store them with a salt, to fight rainbow table attacks. The documentation states:

AuthMySQLSaltField <> | <string> | mysql_column_name

 Contains information on the salt field to be used for crypt and aes
 encryption methods.  It can contain one of the following:
   <>: password itself is the salt field (use with crypt() only)
   <string>: "string" as the salt field
   mysql_column_name: the salt is take from the mysql_column_name field in the
     same row as the password

 This field is required for aes encryption, optional for crypt encryption.
 It is ignored for all other encryption types.

So it looks like the module can do it, but I can't find anything on how to do this? What should I put in the password column? What should I put in the salt? How do I use AES? (Most of the applications will be PHP for creating users)

share|improve this question

2 Answers 2

That depends on what your salt is!

Generally, you might use something that the user can't change, like their ID, as a salt; if that is the case, specify the column that contains the user ID.

If you are using a constant salt, then enclose it in <> marks.

share|improve this answer
    
I wouldn't use a username for a salt, not to start any crypto wars, but if you can just use another random string stored in another column, there's no reason for not so random/possibly malicious user input to be in there. –  reconbot Aug 10 '09 at 18:20
    
I meant a numeric ID - MediaWiki, for example, stores the password as the hash of '#-password', where # is your user ID. See xoa.petdance.com/How_to:_Reset_a_MediaWiki_password –  crb Aug 10 '09 at 19:26

The salt should be a random string not a md5/sha1/256. The docs you presented are looking for the salt to be in it's own column. So you "need" 3 Columns for auth uses

Usersname/email = user submitted
passwordhash = hash(password, passwordsalt)
passwordsalt = random string

You can easily use these columns to verify passwords and create new user records with salt and hash.

Don't ever store plain text passwords.

As for the hash() function, take a look at the phpass library. It's what wordpress turned to when they finally implimented salted hashes in their database.

share|improve this answer
    
so what's the hash function in PHP that I use here? –  Rory Aug 10 '09 at 20:03
    
Here's a blog post with a summary I think mod_auth_mysql can use more then md5 these days. funkatron.com/site/comments/… –  reconbot Aug 11 '09 at 20:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.