starred/modoboa-modoboa

Fork 0

mirror of https://github.com/modoboa/modoboa.git synced 2026-04-26 17:36:01 +03:00

[GH-ISSUE #433] modoboa should support better hash algos and setting the number of rounds used for hashing #417

New issue

Closed

opened 2026-02-27 11:11:39 +03:00 by kerem · 6 comments

kerem commented

2026-02-27 11:11:39 +03:00

Owner

Originally created by @tonioo on GitHub (Dec 4, 2013).
Original GitHub issue: https://github.com/modoboa/modoboa/issues/433

Originally assigned to: @tonioo on GitHub.

Originally created by Marc Schiffbauer on 2013-07-18T12:56:33Z

It should be possible to use and produce hashes like that one for example:

{SHA512-CRYPT}$6$rounds=20000$

Originally created by @tonioo on GitHub (Dec 4, 2013). Original GitHub issue: https://github.com/modoboa/modoboa/issues/433 Originally assigned to: @tonioo on GitHub. **Originally created by Marc Schiffbauer on 2013-07-18T12:56:33Z** It should be possible to use and produce hashes like that one for example: {SHA512-CRYPT}$6$rounds=20000$<the hash>

kerem

2026-02-27 11:11:39 +03:00

closed this issue
added the
bug
label

kerem commented

2026-02-27 11:11:40 +03:00

Author

Owner

@tonioo commented on GitHub (Dec 4, 2013):

Posted by Simon Kern on 2013-07-30T23:34:05Z

If you consider using a different hashing algorith, it should be bcrypt imho - see:
https://docs.djangoproject.com/en/1.5/topics/auth/passwords/

Please note that they use py-bcrypt in Django 1.5 and bcrypt in Django 1.6

@tonioo commented on GitHub (Dec 4, 2013): **Posted by Simon Kern on 2013-07-30T23:34:05Z** If you consider using a different hashing algorith, it should be bcrypt imho - see: https://docs.djangoproject.com/en/1.5/topics/auth/passwords/ Please note that they use _py-bcrypt in Django 1.5_ and _bcrypt in Django 1.6_

kerem commented

2026-02-27 11:11:40 +03:00

Author

Owner

@tonioo commented on GitHub (Dec 4, 2013):

Posted by Marc Schiffbauer on 2013-07-31T09:45:52Z

It should be configurable. We need something that is compatible with the underlying glibc where bcrypt is not available for example because we use these hashes also for dovecot authorization.

@tonioo commented on GitHub (Dec 4, 2013): **Posted by Marc Schiffbauer on 2013-07-31T09:45:52Z** It should be configurable. We need something that is compatible with the underlying glibc where bcrypt is not available for example because we use these hashes also for dovecot authorization.

kerem commented

2026-02-27 11:11:40 +03:00

Author

Owner

@tonioo commented on GitHub (Dec 4, 2013):

Posted by Antoine Nguyen on 2013-11-04T10:27:08Z

It seems passlib could be a good candidate for our need:

http://pythonhosted.org/passlib/index.html

Does anyone know it?

Other question: do we still propose weak schemes? Or do we use only strong schemes (BCRYPT, SHA512-CRYPT, SHA256-CRYPT) ?

@tonioo commented on GitHub (Dec 4, 2013): **Posted by Antoine Nguyen on 2013-11-04T10:27:08Z** It seems passlib could be a good candidate for our need: http://pythonhosted.org/passlib/index.html Does anyone know it? Other question: do we still propose weak schemes? Or do we use only strong schemes (BCRYPT, SHA512-CRYPT, SHA256-CRYPT) ?

kerem commented

2026-02-27 11:11:40 +03:00

Author

Owner

@tonioo commented on GitHub (Dec 4, 2013):

Posted by Marc Schiffbauer on 2013-11-12T09:30:59Z

Antoine Nguyen wrote:

It seems passlib could be a good candidate for our need:

http://pythonhosted.org/passlib/index.html

Does anyone know it?

Other question: do we still propose weak schemes? Or do we use only strong schemes (BCRYPT, SHA512-CRYPT, SHA256-CRYPT) ?

Hi Antoine,

I do not know it, but if it supports the algorithms that gelibc offers and it understands setting rounds in the hash and stuff like that it should be fine from my pov.

@tonioo commented on GitHub (Dec 4, 2013): **Posted by Marc Schiffbauer on 2013-11-12T09:30:59Z** Antoine Nguyen wrote: > It seems passlib could be a good candidate for our need: > > http://pythonhosted.org/passlib/index.html > > Does anyone know it? > > Other question: do we still propose weak schemes? Or do we use only strong schemes (BCRYPT, SHA512-CRYPT, SHA256-CRYPT) ? Hi Antoine, I do not know it, but if it supports the algorithms that gelibc offers and it understands setting rounds in the hash and stuff like that it should be fine from my pov.

kerem commented

2026-02-27 11:11:40 +03:00

Author

Owner

@tonioo commented on GitHub (Dec 4, 2013):

Posted by Antoine Nguyen on 2013-11-13T16:46:10Z

Well, for a first attempt, I'll limit this feature to SHA256-CRYPT and SHA512-CRYPT. BCRYPT is the strongest scheme but very few linux distributions include a compatible glibc. Even if I find a python library to create BCRYPT hashed passwords, dovecot won't be able to use them on most systems.

@Marc: is it fine for you?

@tonioo commented on GitHub (Dec 4, 2013): **Posted by Antoine Nguyen on 2013-11-13T16:46:10Z** Well, for a first attempt, I'll limit this feature to SHA256-CRYPT and SHA512-CRYPT. BCRYPT is the strongest scheme but very few linux distributions include a compatible glibc. Even if I find a python library to create BCRYPT hashed passwords, dovecot won't be able to use them on most systems. @Marc: is it fine for you?

kerem commented

2026-02-27 11:11:40 +03:00

Author

Owner

@tonioo commented on GitHub (Dec 4, 2013):

Posted by Antoine Nguyen on 2013-11-15T16:25:53Z

Applied in changeset commit:949f922ce5f51d2cac05dcaa96aadd758acdfc2e.

@tonioo commented on GitHub (Dec 4, 2013): **Posted by Antoine Nguyen on 2013-11-15T16:25:53Z** Applied in changeset commit:949f922ce5f51d2cac05dcaa96aadd758acdfc2e.