We help IT Professionals succeed at work.

We've partnered with Certified Experts, Carl Webster and Richard Faulkner, to bring you two Citrix podcasts. Learn about 2020 trends and get answers to your biggest Citrix questions!Listen Now

x

Decode/encode for .htpasswd (.htaccess) file

myr
myr asked
on
Medium Priority
25,385 Views
Last Modified: 2008-11-28
Hello...

Anyone know how to encode/decode the passwords
in .htpasswd (Apache Webserver) file ?

A piece of code will be greatly appreciated.

Thanks in advance.


Miranda
myr@dnet.net.id
Comment
Watch Question

Commented:
Apache's .htpasswd uses unix's "crypt" function. crypt is a "one way" encryption method used to encrypt passwords. There is an encode ONLY - no decode. In order to check that a password is correct, you have to encode the proposed password and compare the encrypted result with the encrypted password in the .httpd file. If the encrypted strings match, then the passwords match. The whole idea behind this sort of encryption is that you can't find out what the password is, you can only verify whether a proposed password is correct.

The zipfile at http://free.dom.de/xcrypt.html contains a windows DLL which implements the crypt function, as well as sample VB code (the VB code is very simple, "Text2.Text = crypt(Text1.Text)"). There is source for both the VB code and the DLL (DLL source is in C).

The complexity of the crypt algorithm (DES, basically) makes it impractical to implement in VB, though if you really wanted to you could certainly translate the C source to VB code. It would be slow, though.

If all you want to do is to to generate .htpasswd file entries, then you are all set with the zipfile I just mentioned. If you want to actively check passwords in VB, though, then it's not enough because with that DLL you can't specify the "salt". The "salt" is the 3-character string that is used to initialize the encryption. The encrypted password entries in the .htpasswd file include the correct salt as the first 3 characters - so to check a proposed password, you would get the first three characters from the encrypted password you want to check against, and use those as the salt so the encryption would come out the same. If you want to do this, then you can still use the .zipfile I gave you but will need to recompile the dll. The dll uses a fixed salt rather than one passed as an argument, it would be very easy to make the salt a passed argument as well.

I hope this will do the job for you, it's everything you need to know to do this except for decoding passwords (which as I said is impossible, except via dictionary attack). Please leave a comment if I have been unclear about anything... good luck!

Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts
myr

Author

Commented:
Thank you very much Alamo!
I've donwloaded the DLL and have a try,
it's work just fine (I'm using VB5).

Miranda
myr@dnet.net.id
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.