Hashing multiple user:password combinations (sha)

Jean-Luc Besson · 12-23-2011, 03:04 PM

Hi Everybody,

I just received a spreadsheet containing quite a few user names and (unhashed) passwords. I need to salt these combinations, preferably with SHA. How would I approach such a task, given that I can't script?

What I wanna do with it:
I need to add those salted combinations (user:hashedpw) to a .htgroup file on a web server.

Can anyone help me out? Point me to a script or anything? I really need some help.

Thanks a billion.
Jean-Luc

ntubski · 12-24-2011, 09:12 AM

If you are using apache you should use htpasswd.

If the spread sheet is just a .csv (comma separated value) file it could be as simple as

Code:

tr '\n' , < users.csv | xargs -n2 -d, htpasswd -b -s .htgroup

Watch out for extra columns, or special characters though.

Jean-Luc Besson · 12-24-2011, 10:04 AM

Hi,

thank you for that tip. Just tried it. Converted the contents of the spreadsheet to a csv list containing the "user,password" combinations. Each in it's own line. The spreadsheet is located in my home directory.

If I try your code, I get the following:

Quote:

~$ tr '\n' , < users.csv | xargs -n2 -d, htpasswd -b -s .htgroup
xargs: htpasswd: No such file or directory

Creating a htpasswd file or directory, does not make any difference. What am I doing wrong?

Thank you very much so far for your help.
Jean-Luc.

Jean-Luc Besson · 12-24-2011, 10:18 AM

OK, I'm a few steps further. I had to install htpasswd first. Did that. I also had to add -c to create the htgroup file.

Code:

~$ tr '\n' , < users.csv | xargs -n2 -d, htpasswd -b -s -c .htgroup

all users and names ran through on my terminal....

Code:

...
Adding password for user Zidane
Adding password for user Zorn

Unfortunately the .htgroup file contains only the last user. In this case "Zorn". Does anybody have an idea what I can do to get all users and hashed passwords in that file?

ntubski · 12-24-2011, 08:54 PM

Quote:

Originally Posted by Jean-Luc Besson

I also had to add -c to create the htgroup file.

Quote:

Originally Posted by http://httpd.apache.org/docs/2.2/programs/htpasswd.html

htpasswd - Manage user files for basic authentication
...
Options
...
-c
Create the passwdfile. If passwdfile already exists, it is rewritten and truncated.

Passing -c will overwrite the file on every run (it's somewhat unfortunate there isn't an option to only create if doesn't exist...), maybe use touch to create it first:

Code:

touch .htgroup
tr '\n' , < users.csv | xargs -n2 -d, htpasswd -b -s .htgroup

Jean-Luc Besson · 12-28-2011, 06:28 AM

I must use my brain more.

I was able to get my task done. Thank you very much for all your help. I really appreciate what you've done.