I've my usernames and passwords stored in a mysql db with blowfish encrption. In php I can encrypt the password like this:
crypt($pwd, _SALT_)
where $pwd = 'userpwd' and _SALT_ = $2a$07...
I'm looking for a way to use the user-table also in a VirtualHost with mod_auth_mysql. I know it's possible with md5 using Auth_MySQL_Encryption_Types PHP_MD5 but I'd rather stay with blowfish.
How do I tell mysql_auth to use blowfish? And where do I enter the salt?
EDIT:
Basic problem here is that I have to use a '_' between the key words in the vhost file. So it looks like:
<Location /webdav>
AuthType Basic
AuthName "jst-development"
AuthUserFile /dev/null
AuthBasicAuthoritative Off
Auth_MySQL on
Auth_MySQL_Authoritative on
Auth_MySQL_DB user
Auth_MySQL_User user
...
instead of [taken from http://modauthmysql.sourceforge.net/CONFIGURE]
AuthMySQLDB authdata
AuthMySQLUserTable user_info
AuthMySQLGroupField user_group
to stop apache complaining about the syntax. can someone tell me why or tell me the '_'-syntax for AuthMySQLSaltField <>
//EDIT 2: Version: libapache2-mod-auth-mysql (4.3.9-13ubuntu1)
//EDIT 3: Server version: Apache/2.2.14 (Ubuntu) Exact error when using the 'official syntax' without '_': Invalid command 'AuthMySQLDB', perhaps misspelled or defined by a module not included in the server configuration
use
AuthMySQLPwEncryption crypt
http://modauthmysql.sourceforge.net/CONFIGURE
AuthMySQLPwEncryption none | crypt | scrambled | md5 | aes | sha1 The encryption type used for the passwords in AuthMySQLPasswordField: none: not encrypted (plain text) crypt: UNIX crypt() encryption scrambled: MySQL PASSWORD encryption md5: MD5 hashing aes: Advanced Encryption Standard (AES) encryption sha1: Secure Hash Algorihm (SHA1) WARNING: When using aes encryption, the password field MUST be a BLOB type (i.e. TINYBLOB). MySQL will strip trailing x'20' characters (blanks), EVEN IF THE COLUMN TYPE IS BINARY! AuthMySQLSaltField <> | <string> | mysql_column_name Contains information on the salt field to be used for crypt and aes encryption methods. It can contain one of the following: <>: password itself is the salt field (use with crypt() only) <string>: "string" as the salt field mysql_column_name: the salt is take from the mysql_column_name field in the same row as the password This field is required for aes encryption, optional for crypt encryption. It is ignored for all other encryption types.
modauthmysql seems to not have seen any Developer love for over 7 years. My current guess on your problem is some incompatibility problems this causes with apache 2.2 that you are using.
After looking a bit around on how I would solve the same problem I came across this documentation: http://httpd.apache.org/docs/2.2/mod/mod_authn_dbd.html
This seems to be able to do what you want, provided you configure it right with all its options.
Look for the directive in /usr/share/doc/libapache2-mod-auth-mysql/DIRECTIVES.gz
Path should be specific to your system, the one above is for Debian Lenny