# Sample code for hashing passwords using the below Encryption.py code. # make sure that Encryption.py is on your classpath for this work
from string import split, strip import Encryption
user_name='admin' passwd = 'testing' salt = Encryption.generateSalt() passwd_hash = Encryption.hashPassword(salt, user_name, passwd)
print "checksum = " + salt print "hashed_pw = " + passwd_hash
pass_file = open("password.txt",'w')
pass_file.write("salt=" + salt + "\n")
pass_file.write("password=" + passwd_hash + "\n")
pass_file.close()pass_file = open("password.txt",'r')
checksum = strip(split(pass_file.readline(), "=")[1])
hashed_pw = strip(split(pass_file.readline(), "=")[1])
pass_file.close()print "checksum = " + checksum print "hashed_pw = " + hashed_pw
if (Encryption.authenticateUser(checksum, user_name, passwd, hashed_pw)):
print "Authentication Succeeded"
else:
print "Authentication Failed"
#### END SAMPLE
# BEGIN Encryption.py #
import time, md5, random, base64, string
def generateUniqueId():
# return a 32 bit
md5obj = md5.new()
md5obj.update(str(random.randrange(999999999)))
md5obj.update(str(time.time()))
md5obj.update("webware")
return md5obj.hexdigest()def generateSalt():
return generateUniqueId()def hashPassword(salt, username, password):
md5obj = md5.new()
md5obj.update(username)
md5obj.update(salt)
md5obj.update(password)
return md5obj.hexdigest()
def authenticateUser(checksum, username, password, password_hash):
# compares the hashed username/password with the hash that is stored in the database.
md5obj = md5.new()
md5obj.update(username)
md5obj.update(checksum)
md5obj.update(password)
if (md5obj.hexdigest() == password_hash):
return 1
else:
return 0
On Sunday, February 23, 2003, at 04:17 AM, Ian Bicking wrote:
On Sun, 2003-02-23 at 02:59, Jeremy Lowery wrote:I was wondering what you folks thought about encrypting the admin password
for webware? Personally I just hate a 'su' password sitting in a plain text
file in the config file the way it is.
Certainly that would be good. It would be best to hash the password (with sha1 or md5) rather than encrypt it. It could still be in the normal config file, but we'd have to provide some way to set it through the admin interface, since it would not be obvious to developers how to generate the hash.
-- Ian Bicking [EMAIL PROTECTED] http://colorstudy.com 4869 N. Talman Ave., Chicago, IL 60625 / 773-275-7241 "There is no flag large enough to cover the shame of killing innocent people" -- Howard Zinn
------------------------------------------------------- This SF.net email is sponsored by: SlickEdit Inc. Develop an edge. The most comprehensive and flexible code editor you can use. Code faster. C/C++, C#, Java, HTML, XML, many more. FREE 30-Day Trial. www.slickedit.com/sourceforge _______________________________________________ Webware-discuss mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/webware-discuss
------------------------------------------------------- This SF.net email is sponsored by: SlickEdit Inc. Develop an edge. The most comprehensive and flexible code editor you can use. Code faster. C/C++, C#, Java, HTML, XML, many more. FREE 30-Day Trial. www.slickedit.com/sourceforge _______________________________________________ Webware-discuss mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/webware-discuss
