diff options
author | Matthew Holt <mholt@users.noreply.github.com> | 2019-10-10 14:37:27 -0600 |
---|---|---|
committer | Matthew Holt <mholt@users.noreply.github.com> | 2019-10-10 14:37:27 -0600 |
commit | f8366c2f09c77a55dc53038cae0b101263488867 (patch) | |
tree | 359105a5265369a6510342291715d6fe556c5250 /modules/caddyhttp/caddyauth/command.go | |
parent | fe36d26b63b6398592e46604d1795f84ce0477d4 (diff) |
http: authentication module; hash-password cmd; http_basic provider
This implements HTTP basicauth into Caddy 2. The basic auth module will
not work with passwords that are not securely hashed, so a subcommand
hash-password was added to make it convenient to produce those hashes.
Also included is Caddyfile support.
Closes #2747.
Diffstat (limited to 'modules/caddyhttp/caddyauth/command.go')
-rw-r--r-- | modules/caddyhttp/caddyauth/command.go | 80 |
1 files changed, 80 insertions, 0 deletions
diff --git a/modules/caddyhttp/caddyauth/command.go b/modules/caddyhttp/caddyauth/command.go new file mode 100644 index 0000000..c110001 --- /dev/null +++ b/modules/caddyhttp/caddyauth/command.go @@ -0,0 +1,80 @@ +// Copyright 2015 Matthew Holt and The Caddy Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package caddyauth + +import ( + "encoding/base64" + "flag" + "fmt" + + "github.com/caddyserver/caddy/v2" + caddycmd "github.com/caddyserver/caddy/v2/cmd" + "golang.org/x/crypto/bcrypt" + "golang.org/x/crypto/scrypt" +) + +func init() { + caddycmd.RegisterCommand(caddycmd.Command{ + Name: "hash-password", + Func: cmdHashPassword, + Usage: "--plaintext <password> [--salt <string>] [--algorithm <name>]", + Short: "Hashes a password and writes base64", + Long: ` +Convenient way to hash a plaintext password. The resulting +hash is written to stdout as a base64 string. + +--algorithm may be bcrypt or scrypt. If script, the default +parameters are used. + +Use the --salt flag for algorithms which require a salt to +be provided (scrypt). +`, + Flags: func() *flag.FlagSet { + fs := flag.NewFlagSet("hash-password", flag.ExitOnError) + fs.String("algorithm", "bcrypt", "Name of the hash algorithm") + fs.String("plaintext", "", "The plaintext password") + fs.String("salt", "", "The password salt") + return fs + }(), + }) +} + +func cmdHashPassword(fs caddycmd.Flags) (int, error) { + algorithm := fs.String("algorithm") + plaintext := []byte(fs.String("plaintext")) + salt := []byte(fs.String("salt")) + + var hash []byte + var err error + switch algorithm { + case "bcrypt": + hash, err = bcrypt.GenerateFromPassword(plaintext, bcrypt.DefaultCost) + case "scrypt": + def := ScryptHash{} + def.SetDefaults() + hash, err = scrypt.Key(plaintext, salt, def.N, def.R, def.P, def.KeyLength) + default: + return caddy.ExitCodeFailedStartup, fmt.Errorf("unrecognized hash algorithm: %s", algorithm) + } + if err != nil { + return caddy.ExitCodeFailedStartup, err + } + + hashBase64 := base64.StdEncoding.EncodeToString([]byte(hash)) + + fmt.Println(hashBase64) + + return 0, nil +} |