Open bwbroersma opened 7 months ago
Do or should we also have a minimum password length? And do or should we also ratelimit login attempts?
If only encrypted passwords are accepted there is no option to enforce a password policy on the encrypted passwords. It looks like bcrypt ($2y$
) is not supported by ngx_http_auth_basic_module.
One could maybe add some custom deny policy in nginx to deny short passwords, but that would be very custom so probably not a good idea for maintainability.
_Update: double checked the algorithm support in the code and ~it's confirmed there is no bcrypt support~ there is bcrypt support via the fallback code to crypt in libc ._
Currently there is an option to provide
*_AUTH
and*_AUTH_RAW
env variables, both allow unhashed passwords.Initially I proposed some bash to auto-hash all non hashed passwords
But @mxsasha proposed something way better than adding bash code: filter out the bad practice of using non encrypted passwords, so only encrypted passwords are accepted.
The current code: https://github.com/internetstandards/Internet.nl/blob/7bb8f53b97ffe467080884250bc0a81f029a978c/docker/webserver/generate_htpasswd.sh#L1-L9
Idea to drop
*_AUTH
and to add a grep filter to the*_AUTH_RAW
:Since users cannot have a
:
, and bcrypt and md5 passwords use the special$2y$
and$apr1
. Of course this can be fooled with a plaintext password that starts with the same magic value, but that would also fool htpasswd, so the user cannot login anyway.Demo: