* caddyauth: Support third-party http.authentication.hashes modules
basic_auth and hash-password only accepted the built-in bcrypt and
argon2id algorithms, even though the http.authentication.hashes
namespace is documented as extensible. Look up any other algorithm
name among the installed hash modules instead, and list the available
ones when the name is not recognized.
The built-in algorithms keep their own hash-password flags; other
modules are provisioned and must implement Hasher to generate hashes.
Closes#6670
* caddyauth: Base64-encode non-MCF hashes from hash-password modules
hash-password printed module hashes as raw bytes, but basic_auth
base64-decodes any password that isn't in Modular Crypt Format, so the
output couldn't be used as-is. Encode non-MCF hashes as base64 and add
a round-trip test that provisions HTTPBasicAuth with the command output.
* caddyauth: always base64-encode third-party hash output
A password piped with a Windows line ending was hashed with the trailing
\r, so basic_auth rejected the real password, and input without a final
newline failed with EOF.
* feat: add bcrypt cost parameter to hash-password
* revert: typos
* refactor: take the cost out of interface
* fix: default bcrypt cost to 14
* fix: follow bcrypt library for min and max cost
* doc: mention defaultBcryptCost in cost parameter description
* chore: gci format
* fix: more specific bcrypt cost algorithm flag
* feat: bcrypt cost provisioning
* Revert "feat: bcrypt cost provisioning"
This reverts commit e09d4bd036.
* chore: gci format
* chore: gci format
* chore: gci format
* chore: golangcilint fmted
---------
Co-authored-by: Mohammed Al Sahaf <msaa1990@gmail.com>
* use gofmput to format code
* use gci to format imports
* reconfigure gci
* linter autofixes
* rearrange imports a little
* export GOOS=windows golangci-lint run ./... --fix
The docs at os/signal.Notify warn about this signal delivery loss bug at
https://golang.org/pkg/os/signal/#Notify, which says:
Package signal will not block sending to c: the caller must ensure
that c has sufficient buffer space to keep up with the expected signal
rate. For a channel used for notification of just one signal value,
a buffer of size 1 is sufficient.
Caught by a static analysis tool from Orijtech, Inc. called "sigchanyzer"
Always follow the code path of hashing and comparing a plaintext
password even if the account is not found by the given username; this
ensures that similar CPU cycles are spent for both valid and invalid
usernames.
Thanks to @tylerlm for helping and looking into this!
Closes#3365
* http: Add support in hash-password for reading from terminals/stdin
* FIXUP: Run gofmt -s
* FIXUP
* FIXUP: Apply suggestions from code review
Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
* FIXUP
Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
This implements HTTP basicauth into Caddy 2. The basic auth module will
not work with passwords that are not securely hashed, so a subcommand
hash-password was added to make it convenient to produce those hashes.
Also included is Caddyfile support.
Closes#2747.
hsdfat
Jay Hemnani
GreyXor
Francis Lavoie
Jacob Gadikian
Simão Gomes Viana
Cuong Manh Le
Andrew ZhouandMatt Holt