bash Apache htpasswd 安全密码更改
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/4736413/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Apache htpasswd secure password change
提问by Rusty Horse
My question is simple.
我的问题很简单。
How to allow users to change their passwords stored in some htpasswd file in linux without revealing the files content or allow users to modify other passwords?
如何允许用户更改存储在 linux 中某些 htpasswd 文件中的密码而不泄露文件内容或允许用户修改其他密码？
I tried to write a script to do that job using ssh and specialy-designed user but it leads noway.
我试图编写一个脚本来使用 ssh 和专门设计的用户来完成这项工作，但它没有成功。
Please help. I am using Debian server "Lenny".
请帮忙。我正在使用 Debian 服务器“Lenny”。
回答by ceving
The Apache htpasswdfile does not support any shadow functionality. Therefor you have to prevent the users accessing your web server in order to keep them away from the password file. So the only solution is your SSH based approach or any other remote solution. The following description will explain how to write a SSH command script to change the password only if the user knows his old password. The major problem is, that Apache does not provide a command line tool to verify a password in a htpasswdfile. But this can be done by hand.
Apachehtpasswd文件不支持任何影子功能。因此，您必须阻止用户访问您的 Web 服务器，以使他们远离密码文件。因此，唯一的解决方案是基于 SSH 的方法或任何其他远程解决方案。下面的描述将解释如何编写 SSH 命令脚本来仅在用户知道其旧密码的情况下更改密码。主要问题是，Apache 没有提供命令行工具来验证htpasswd文件中的密码。但这可以手动完成。
The following description assumes that the web server user is www-dataand that the home directory of the user is /var/www.
以下描述假设 Web 服务器用户是www-data并且用户的主目录是/var/www。
First you have to create a htpasswd file, that is writable by the web server user:
首先，您必须创建一个 htpasswd 文件，该文件可由 Web 服务器用户写入：
# ls -la .htpasswd
-rw-r--r-- 1 www-data root 18 10. Mai 16:30 .htpasswd
Then you have to add the keys of all your users to the authorized_keysfile of the web server user. You have to prefix each line with the commandoption.
然后，您必须将所有用户的密钥添加到authorized_keysWeb 服务器用户的文件中。您必须在每行前面加上command选项。
# cat .ssh/authorized_keys
command="/var/www/.htpasswd.sh" ssh-rsa AAAA... user@host
Whenever a user connects with his key only the .htpasswd.shgets executed. The users do not have any shell access to the web server.
每当用户使用他的密钥连接时，只会.htpasswd.sh执行。用户没有对 Web 服务器的任何 shell 访问权限。
This is the script to change the password:
这是更改密码的脚本：
#! /bin/bash
HTPASSWD=/var/www/.htpasswd
die () { echo "$*" >&2 ; exit 1 ; }
read -p 'Enter user name: ' USER
read -s -p 'Old password: ' OLDPW ; echo
read -s -p 'New password: ' NEWPW0 ; echo
read -s -p 'Re-type new password: ' NEWPW1 ; echo
if LINE=$(grep ^"$USER": "$HTPASSWD")
then
echo "$LINE" | sed 's/.*:\(..\)\(.\+\)/ /' | {
read SALT CRYPT
if [[ "$SALT$CRYPT" = $(echo "$OLDPW" | mkpasswd -sS "$SALT") ]] ; then
if [ "$NEWPW0" != "$NEWPW1" ] ; then
die "Password verification error!"
fi
PWS=$(grep -v ^"$USER:" "$HTPASSWD")
{
echo "$PWS"
echo -n "$USER:"
echo "$NEWPW0" | mkpasswd -s
} > "$HTPASSWD"
echo "Updating password for user $USER."
else
die "Password verification error!"
fi
}
else
die "Password verification error!"
fi
The tricky part is the password verification. It is done by reading the old salt and encrypting the old password with the old salt. The result is compared with the old encrypted password in the htpasswdfile.
棘手的部分是密码验证。它是通过读取旧盐并用旧盐加密旧密码来完成的。结果与htpasswd文件中的旧加密密码进行比较。
Now the user can connect to the web server in order to change the password:
现在用户可以连接到 Web 服务器以更改密码：
$ ssh www-data@localhost
Enter user name: szi
Old password:
New password:
Re-type new password:
Updating password for user szi.
Connection to localhost closed.
Everybody can change only his own password and nobody has access to the encrypted passwords of the other users. This solution has an additional benefit about using the original htpasswdprogram in a shell script, because the passwords are never used as a command line argument. This would not be possible with htpasswd, because it can not read the password from stdin like mkpasswd.
每个人只能更改自己的密码，没有人可以访问其他用户的加密密码。这个解决htpasswd方案在 shell 脚本中使用原始程序还有一个额外的好处，因为密码从不用作命令行参数。这是不可能的htpasswd，因为它不能像mkpasswd.
