Solved

Decode/encode for .htpasswd (.htaccess) file

Posted on 1997-11-15
2
20,268 Views
Last Modified: 2008-11-28
Hello...

Anyone know how to encode/decode the passwords
in .htpasswd (Apache Webserver) file ?

A piece of code will be greatly appreciated.

Thanks in advance.


Miranda
myr@dnet.net.id
0
Comment
Question by:myr
2 Comments
 
LVL 6

Accepted Solution

by:
alamo earned 200 total points
ID: 1441011
Apache's .htpasswd uses unix's "crypt" function. crypt is a "one way" encryption method used to encrypt passwords. There is an encode ONLY - no decode. In order to check that a password is correct, you have to encode the proposed password and compare the encrypted result with the encrypted password in the .httpd file. If the encrypted strings match, then the passwords match. The whole idea behind this sort of encryption is that you can't find out what the password is, you can only verify whether a proposed password is correct.

The zipfile at http://free.dom.de/xcrypt.html contains a windows DLL which implements the crypt function, as well as sample VB code (the VB code is very simple, "Text2.Text = crypt(Text1.Text)"). There is source for both the VB code and the DLL (DLL source is in C).

The complexity of the crypt algorithm (DES, basically) makes it impractical to implement in VB, though if you really wanted to you could certainly translate the C source to VB code. It would be slow, though.

If all you want to do is to to generate .htpasswd file entries, then you are all set with the zipfile I just mentioned. If you want to actively check passwords in VB, though, then it's not enough because with that DLL you can't specify the "salt". The "salt" is the 3-character string that is used to initialize the encryption. The encrypted password entries in the .htpasswd file include the correct salt as the first 3 characters - so to check a proposed password, you would get the first three characters from the encrypted password you want to check against, and use those as the salt so the encryption would come out the same. If you want to do this, then you can still use the .zipfile I gave you but will need to recompile the dll. The dll uses a fixed salt rather than one passed as an argument, it would be very easy to make the salt a passed argument as well.

I hope this will do the job for you, it's everything you need to know to do this except for decoding passwords (which as I said is impossible, except via dictionary attack). Please leave a comment if I have been unclear about anything... good luck!
0
 

Author Comment

by:myr
ID: 1441012
Thank you very much Alamo!
I've donwloaded the DLL and have a try,
it's work just fine (I'm using VB5).

Miranda
myr@dnet.net.id
0

Featured Post

Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When trying to find the cause of a problem in VBA or VB6 it's often valuable to know what procedures were executed prior to the error. You can use the Call Stack for that but it is often inadequate because it may show procedures you aren't intereste…
Since upgrading to Office 2013 or higher installing the Smart Indenter addin will fail. This article will explain how to install it so it will work regardless of the Office version installed.
Get people started with the process of using Access VBA to control Excel using automation, Microsoft Access can control other applications. An example is the ability to programmatically talk to Excel. Using automation, an Access application can laun…
Get people started with the utilization of class modules. Class modules can be a powerful tool in Microsoft Access. They allow you to create self-contained objects that encapsulate functionality. They can easily hide the complexity of a process from…

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question