From f8366c2f09c77a55dc53038cae0b101263488867 Mon Sep 17 00:00:00 2001
From: Matthew Holt <mholt@users.noreply.github.com>
Date: Thu, 10 Oct 2019 14:37:27 -0600
Subject: http: authentication module; hash-password cmd; http_basic provider

This implements HTTP basicauth into Caddy 2. The basic auth module will
not work with passwords that are not securely hashed, so a subcommand
hash-password was added to make it convenient to produce those hashes.

Also included is Caddyfile support.

Closes #2747.
---
 modules/caddyhttp/caddyauth/command.go | 80 ++++++++++++++++++++++++++++++++++
 1 file changed, 80 insertions(+)
 create mode 100644 modules/caddyhttp/caddyauth/command.go

(limited to 'modules/caddyhttp/caddyauth/command.go')

diff --git a/modules/caddyhttp/caddyauth/command.go b/modules/caddyhttp/caddyauth/command.go
new file mode 100644
index 0000000..c110001
--- /dev/null
+++ b/modules/caddyhttp/caddyauth/command.go
@@ -0,0 +1,80 @@
+// Copyright 2015 Matthew Holt and The Caddy Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package caddyauth
+
+import (
+	"encoding/base64"
+	"flag"
+	"fmt"
+
+	"github.com/caddyserver/caddy/v2"
+	caddycmd "github.com/caddyserver/caddy/v2/cmd"
+	"golang.org/x/crypto/bcrypt"
+	"golang.org/x/crypto/scrypt"
+)
+
+func init() {
+	caddycmd.RegisterCommand(caddycmd.Command{
+		Name:  "hash-password",
+		Func:  cmdHashPassword,
+		Usage: "--plaintext <password> [--salt <string>] [--algorithm <name>]",
+		Short: "Hashes a password and writes base64",
+		Long: `
+Convenient way to hash a plaintext password. The resulting
+hash is written to stdout as a base64 string.
+
+--algorithm may be bcrypt or scrypt. If script, the default
+parameters are used.
+
+Use the --salt flag for algorithms which require a salt to
+be provided (scrypt).
+`,
+		Flags: func() *flag.FlagSet {
+			fs := flag.NewFlagSet("hash-password", flag.ExitOnError)
+			fs.String("algorithm", "bcrypt", "Name of the hash algorithm")
+			fs.String("plaintext", "", "The plaintext password")
+			fs.String("salt", "", "The password salt")
+			return fs
+		}(),
+	})
+}
+
+func cmdHashPassword(fs caddycmd.Flags) (int, error) {
+	algorithm := fs.String("algorithm")
+	plaintext := []byte(fs.String("plaintext"))
+	salt := []byte(fs.String("salt"))
+
+	var hash []byte
+	var err error
+	switch algorithm {
+	case "bcrypt":
+		hash, err = bcrypt.GenerateFromPassword(plaintext, bcrypt.DefaultCost)
+	case "scrypt":
+		def := ScryptHash{}
+		def.SetDefaults()
+		hash, err = scrypt.Key(plaintext, salt, def.N, def.R, def.P, def.KeyLength)
+	default:
+		return caddy.ExitCodeFailedStartup, fmt.Errorf("unrecognized hash algorithm: %s", algorithm)
+	}
+	if err != nil {
+		return caddy.ExitCodeFailedStartup, err
+	}
+
+	hashBase64 := base64.StdEncoding.EncodeToString([]byte(hash))
+
+	fmt.Println(hashBase64)
+
+	return 0, nil
+}
-- 
cgit v1.2.3