Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (asf.osuosl.org: domain of jacob.arun@gmail.com designates
 64.233.166.181 as permitted sender)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
        s=beta; d=gmail.com;
        h=received:message-id:date:from:to:subject:mime-version:content-type;
        b=Z4d9V4C08CCAA4BAYhreKL1HuLpoJQlFJxublVTjeXoaRhCC9tT4It5uPRZpopB3obK5IHqUDIWCR8xqdkqzrw+8DQ2nU+AVLMTTdEEUKUfgnzwVAfHwQANbN7oJ25bnUhoflvjneU2Qj3el2nKMnQzPBZZTcwt3X8ZwIdooGjU=
Message-ID: <56f5e4ea0604260552l4a7eab89m8d79910f8792d49b@mail.gmail.com>
Date: Wed, 26 Apr 2006 20:52:15 +0800
From: "Arun Jacob" <jacob.arun@gmail.com>
To: users@httpd.apache.org
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_Part_9455_27810026.1146055935346"
Subject: [users@httpd] htadm and htpasswd

------=_Part_9455_27810026.1146055935346
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Background
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Currently, we have an web application running on an OS/390 mainframe under
mainframe Unix Shared Services. The webserver is IBM HTTP Server, which is =
a
rebranded version of Apache.

This application is being migrated to AIX.

Currently in the mainframe, the password hashing and verification is being
done by a utility called HTADM that comes with IBM HTTP Server on OS/390.
For generating a hash of a plaintext_pwd, HTADM uses the Unix crypt(3) with
a random 2 char salt. 1st 2 chars of the generated hash is the salt.
To verify a cleartext_pwd against the stored hash_pwd for a user, HTADM
takes the 1st 2 chars of the hash as the salt and passes it with the
cleartext_pwd to crypt(3) to generate another hash. This hash should be the
same as the stored hash

My questions
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>> HTADM is not available on IBM HTTP Server for Apache. How can I get it?
I can find only htpasswd, which is limited in functionality compared to
htadm

>> htpasswd limitation is that it cannot verify a password to one that is
passed to it. At least the parameters dont have the option. Is there a way
to use htpasswd to verify a stored password

>> I got a set of cleartext_pwd ----> hash mappings generated on the OS/390
using HTADM. Now i tried to verify if I could get the same hash using a
separate implementation of crypt(3) found on this website.
http://javascript.internet.com/passwords/unix-crypt(3)-encryption.html
But the hash generated using this separate implementation does not match.

So is crypt(3) implemented differently on OS/390 comapred to AIX and other
Unix OS's.


Thanks in advance

------=_Part_9455_27810026.1146055935346
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Background<br>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D<br>Currently, we have an web application running on an OS/390 mainframe=
 under mainframe Unix Shared Services. The webserver is IBM HTTP Server, wh=
ich is a rebranded version of Apache. <br>
<br>This application is being migrated to AIX.<br><br>Currently in the main=
frame, the password hashing and verification is being done by a utility cal=
led HTADM that comes with IBM HTTP Server on OS/390. &nbsp;<br>For generati=
ng a hash of a plaintext_pwd, HTADM uses the Unix crypt(3) with a random 2 =
char salt. 1st 2 chars of the generated hash is the salt.
<br>To verify a cleartext_pwd against the stored hash_pwd for a user, HTADM=
 takes the 1st 2 chars of the hash as the salt and passes it with the clear=
text_pwd to crypt(3) to generate another hash. This hash should be the same=
 as the stored hash
<br><br>My questions<br>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D<br>&gt;&gt; HTADM is not available on IBM HTTP Server for A=
pache. How can I get it?<br>I can find only htpasswd, which is limited in f=
unctionality compared to htadm<br><br>&gt;&gt; htpasswd limitation is that =
it cannot verify a password to one that is passed to it. At least the param=
eters dont have the option. Is there a way to use htpasswd to verify a stor=
ed password
<br><br>&gt;&gt; I got a set of cleartext_pwd ----&gt; hash mappings genera=
ted on the OS/390 using HTADM. Now i tried to verify if I could get the sam=
e hash using a separate implementation of crypt(3) found on this website.
<br><a href=3D"http://javascript.internet.com/passwords/unix-crypt(3)-encry=
ption.html">http://javascript.internet.com/passwords/unix-crypt(3)-encrypti=
on.html</a> <br>But the hash generated using this separate implementation d=
oes not match.
<br><br>So is crypt(3) implemented differently on OS/390 comapred to AIX an=
d other Unix OS's.<br><br><br>Thanks in advance<br><br>

------=_Part_9455_27810026.1146055935346--