Browse Source

Recommend bcrypt passwords everywhere

pipelines/225221287
Henri Menke 3 months ago
committed by Antoine Eiche
parent
commit
89bd89c706
8 changed files with 19 additions and 15 deletions
  1. +1
    -1
      README.md
  2. +6
    -6
      default.nix
  3. +5
    -1
      docs/howto-add-radicale.rst
  4. +1
    -1
      docs/quick-start.rst
  5. +1
    -1
      docs/setup-guide.rst
  6. +1
    -1
      mail-server/dovecot.nix
  7. +2
    -2
      tests/intern.nix
  8. +2
    -2
      tests/multiple.nix

+ 1
- 1
README.md View File

@ -96,7 +96,7 @@ See the [mailing list archive](https://www.freelists.org/archive/snm/)
domains = [ "example.com" "example2.com" ];
loginAccounts = {
"user1@example.com" = {
# mkpasswd -m sha-512 "super secret password" > /hashed/password/file/location
# nix run nixpkgs.apacheHttpd -c htpasswd -nbB "" "super secret password" | cut -d: -f2 > /hashed/password/file/location
hashedPasswordFile = "/hashed/password/file/location";
aliases = [


+ 6
- 6
default.nix View File

@ -59,10 +59,10 @@ in
default = null;
example = "$6$evQJs5CFQyPAW09S$Cn99Y8.QjZ2IBnSu4qf1vBxDRWkaIZWOtmu1Ddsm3.H3CFpeVc0JU4llIq8HQXgeatvYhh5O33eWG3TSpjzu6/";
description = ''
The user's hashed password. Use `mkpasswd` as follows
The user's hashed password. Use `htpasswd` as follows
```
mkpasswd -m sha-512 "super secret password"
nix run nixpkgs.apacheHttpd -c htpasswd -nbB "" "super secret password" | cut -d: -f2
```
Warning: this is stored in plaintext in the Nix store!
@ -75,10 +75,10 @@ in
default = null;
example = "/run/keys/user1-passwordhash";
description = ''
A file containing the user's hashed password. Use `mkpasswd` as follows
A file containing the user's hashed password. Use `htpasswd` as follows
```
mkpasswd -m sha-512 "super secret password"
nix run nixpkgs.apacheHttpd -c htpasswd -nbB "" "super secret password" | cut -d: -f2
```
'';
};
@ -171,11 +171,11 @@ in
};
description = ''
The login account of the domain. Every account is mapped to a unix user,
e.g. `user1@example.com`. To generate the passwords use `mkpasswd` as
e.g. `user1@example.com`. To generate the passwords use `htpasswd` as
follows
```
mkpasswd -m sha-512 "super secret password"
nix run nixpkgs.apacheHttpd -c htpasswd -nbB "" "super secret password" | cut -d: -f2
```
'';
default = {};


+ 5
- 1
docs/howto-add-radicale.rst View File

@ -3,6 +3,10 @@ How to Add Radicale to SNM
Configuration by @dotlambda
Starting with Radicale 3 (first introduced in NixOS 20.09) the traditional
crypt passwords, as generated by `mkpasswd`, are no longer supported. Instead
bcrypt passwords have to be used which can be generated using `htpasswd`.
.. code:: nix
{ config, pkgs, lib, ... }:
@ -24,7 +28,7 @@ Configuration by @dotlambda
[auth]
type = htpasswd
htpasswd_filename = ${htpasswd}
htpasswd_encryption = crypt
htpasswd_encryption = bcrypt
'';
};


+ 1
- 1
docs/quick-start.rst View File

@ -20,7 +20,7 @@ Quick Start
domains = [ "example.com" "example2.com" ];
loginAccounts = {
"user1@example.com" = {
# mkpasswd -m sha-512 "super secret password" > /hashed/password/file/location
# nix run nixpkgs.apacheHttpd -c htpasswd -nbB "" "super secret password" | cut -d: -f2 > /hashed/password/file/location
hashedPasswordFile = "/hashed/password/file/location";
aliases = [


+ 1
- 1
docs/setup-guide.rst View File

@ -46,7 +46,7 @@ should be the most common ones.
domains = [ <domains> ];
# A list of all login accounts. To create the password hashes, use
# mkpasswd -m sha-512 "super secret password"
# nix run nixpkgs.apacheHttpd -c htpasswd -nbB "" "super secret password" | cut -d: -f2
loginAccounts = {
"user1@example.com" = {
hashedPassword = "$6$/z4n8AQl6K$kiOkBTWlZfBd7PvF5GsJ8PmPgdZsFGN1jPGZufxxr60PoR0oUsrvzm2oQiflyz5ir9fFJ.d/zKm/NgLXNUsNX/";


+ 1
- 1
mail-server/dovecot.nix View File

@ -70,7 +70,7 @@ let
cat <<EOF > ${passwdFile}
${lib.concatStringsSep "\n" (lib.mapAttrsToList (name: value:
"${name}:${"$(cat ${passwordFiles."${name}"})"}:${builtins.toString cfg.vmailUID}:${builtins.toString cfg.vmailUID}::${cfg.mailDirectory}:/run/current-system/sw/bin/nologin:"
"${name}:${"$(head -n 1 ${passwordFiles."${name}"})"}:${builtins.toString cfg.vmailUID}:${builtins.toString cfg.vmailUID}::${cfg.mailDirectory}:/run/current-system/sw/bin/nologin:"
+ (if lib.isString value.quota
then "userdb_quota_rule=*:storage=${value.quota}"
else "")


+ 2
- 2
tests/intern.nix View File

@ -29,8 +29,8 @@ let
hashPassword = password: pkgs.runCommand
"password-${password}-hashed"
{ buildInputs = [ pkgs.mkpasswd ]; } ''
mkpasswd -m sha-512 ${password} > $out
{ buildInputs = [ pkgs.apacheHttpd ]; } ''
htpasswd -nbB "" "${password}" | cut -d: -f2 > $out
'';
in


+ 2
- 2
tests/multiple.nix View File

@ -5,9 +5,9 @@
let
hashPassword = password: pkgs.runCommand
"password-${password}-hashed"
{ buildInputs = [ pkgs.mkpasswd ]; }
{ buildInputs = [ pkgs.apacheHttpd ]; }
''
mkpasswd -m sha-512 ${password} > $out
htpasswd -nbB "" "${password}" | cut -d: -f2 > $out
'';
password = pkgs.writeText "password" "password";


Loading…
Cancel
Save