Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here. |
Notices |
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
Are you new to LinuxQuestions.org? Visit the following links:
Site Howto |
Site FAQ |
Sitemap |
Register Now
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
|
 |
12-26-2005, 02:40 PM
|
#1
|
Member
Registered: Aug 2005
Distribution: Debian
Posts: 355
Rep:
|
htpasswd convert
is there anyway of converting the password file back to the password?
|
|
|
12-26-2005, 04:11 PM
|
#2
|
Senior Member
Registered: Nov 2002
Location: Silly Con Valley
Distribution: Red Hat 7.3, Red Hat 9.0
Posts: 2,054
Rep:
|
what's up with these script kiddie kind of questions, today?
You don't need to uncode htpasswd for a user. If you need to change this users password, you just change it.
|
|
|
12-26-2005, 06:15 PM
|
#3
|
Member
Registered: Aug 2005
Distribution: Debian
Posts: 355
Original Poster
Rep:
|
yes just wondering if someone get there hands on the password file for it would they be able to convert it back?
|
|
|
12-26-2005, 06:24 PM
|
#4
|
Senior Member
Registered: Nov 2002
Location: Silly Con Valley
Distribution: Red Hat 7.3, Red Hat 9.0
Posts: 2,054
Rep:
|
how would someone get their hands on the .htpasswd file?
The only way would be if you're running some old unpatched apache version that has some kind of remote exploit or if you allow something like ssh and haven't changed the permissions on your .htpasswd file. If someone has gotten a hold of your .htpasswd, you need to to upgrade to the latest apache version and change the passwords on your .htpasswd file for that directory and change the permissions of the .htpasswd files to be inaccessible to others.
|
|
|
12-26-2005, 06:33 PM
|
#5
|
Member
Registered: Sep 2002
Posts: 310
Rep: 
|
What if I owned your Red Hat 7.3?
|
|
|
12-26-2005, 07:06 PM
|
#6
|
Senior Member
Registered: Nov 2002
Location: Silly Con Valley
Distribution: Red Hat 7.3, Red Hat 9.0
Posts: 2,054
Rep:
|
what if you did? the last thing you need to do is to convert .htpasswd... you have complete access to the system.
|
|
|
12-26-2005, 07:15 PM
|
#7
|
Member
Registered: Sep 2002
Posts: 310
Rep: 
|
Precisely. So stop throwing a tantrum in this thread.
namit: The premise of htpasswd is similar to system passwords in Unix/Linux. A hash of the password is made. The password can be cracked, but the hash cannot be reversed to enumerate the password.
|
|
|
12-26-2005, 07:23 PM
|
#8
|
Senior Member
Registered: Nov 2002
Location: Silly Con Valley
Distribution: Red Hat 7.3, Red Hat 9.0
Posts: 2,054
Rep:
|
I was throwing a tantrum? I'm just trying to understand why this question was asked. There's no real way to get someone's .htpasswd file unless someone's machine got owned. And if someone's machine got owned, an attacker's not going to bother with .htpasswd. The parent poster's question seemed more like wanting some tool or some way of breaking htpasswd. If this is the poster's own system, there's ways of making it so no one other than the apache process and/or the root user can see the .htaccess file. In other words, I felt I answered the question in such a way that you wouldn't have to worry about a compromised .htpasswd file.
|
|
|
All times are GMT -5. The time now is 12:03 AM.
|
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
|
Latest Threads
LQ News
|
|