windows 使用python在windows上创建兼容的ldap密码（md5crypt）
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/4070601/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
use python to create compatible ldap password (md5crypt) on windows
提问by giskard
Do you know how to create a ldap compatible password (preferred md5crypt) via python on Windows
您知道如何在 Windows 上通过 python 创建 ldap 兼容密码（首选 md5crypt）吗？
I used to write something like this in Linux but the crypt module is not present on Windows
我曾经在 Linux 中写过类似的东西，但 Windows 上不存在 crypt 模块
char_set = string.ascii_uppercase + string.digits
salt = ''.join(random.sample(char_set,8))
salt = '$' + salt + '$'
pwd = "{CRYPT}" + crypt.crypt(str(old_password),salt)
回答by Eli Collins
The Passlibpython library contains cross-platform implementations of all the crypt(3) algorithms. In particular, it contains ldap_md5_crypt, which sounds like exactly what you want. Here's how to use it (this code will work on windows or linux):
所述Passlib蟒库包含的所有的隐窝（3）的算法的跨平台实现。特别是，它包含ldap_md5_crypt，这听起来正是您想要的。以下是它的使用方法（此代码适用于 windows 或 linux）：
from passlib.hash import ldap_md5_crypt
#note salt generation is automatically handled
hash = ldap_md5_crypt.encrypt("password")
#hash will be similar to '{CRYPT}$wa6OLvW3$uzcIj2Puf3GcFDf2KztQN0'
#to verify a password...
valid = ldap_md5_crypt.verify("password", hash)
I should note that while MD5-Crypt is widely supported (Linux, all the BSDs, internally in openssl), it's none-the-less not the strongest hash availablereally horribly insecure, and should be avoided if at all possible. If you want the strongest hash that's compatible with linux crypt(), SHA512-Crypt is probably the way to go. It adds variable rounds, as well as some other improvements over MD5-Crypt internally.
我应该注意到，虽然 MD5-Crypt 得到广泛支持（Linux、所有 BSD，在 openssl 内部），但它仍然不是可用的最强哈希，真正非常不安全，应该尽可能避免。如果您想要与 linux crypt() 兼容的最强哈希，SHA512-Crypt 可能是您要走的路。它在内部增加了可变轮次，以及对 MD5-Crypt 的一些其他改进。
回答by ipeacocks
From here http://www.openldap.org/faq/data/cache/347.html
从这里http://www.openldap.org/faq/data/cache/347.html
One of the variants for generating SHA-hash can be:
生成 SHA-hash 的变体之一可以是：
import sha
from base64 import b64encode
ctx = sha.new("your_password")
hash = "{SHA}" + b64encode(ctx.digest())
print(hash)
This code is for Python.
此代码适用于 Python。
# python my_sha.py
{SHA}Vk40DNSEN9Lf6HbuFUzJncTQ0Tc=
I (and not only me) don'trecommend to use MD5 anymore.
我（不仅仅是我）不再推荐使用 MD5。
PS. Follow the link you can try some windows variants.
附注。按照链接，您可以尝试一些 Windows 变体。
回答by Rafe Kettler
回答by Katriel
Disclaimer: I know Google, not cryptography.
免责声明：我知道谷歌，而不是密码学。
From the cryptdocs:
从crypt文档：
This module implements an interface to the crypt(3) routine, which is a one-way hash function based upon a modified DES algorithm; see the Unix man page for further details. Possible uses include allowing Python scripts to accept typed passwords from the user, or attempting to crack Unix passwords with a dictionary.
该模块实现了 crypt(3) 例程的接口，该例程是基于修改的 DES 算法的单向哈希函数；有关更多详细信息，请参阅 Unix 手册页。可能的用途包括允许 Python 脚本接受用户输入的密码，或尝试使用字典破解 Unix 密码。
You could have a look at md5crypt.py. Alternatively, cryptfor Windowsis part of GnuWin32. Here's some of the Unix man page; the Windows interface should be similar.
你可以看看md5crypt.py。或者，crypt对于 Windows是GnuWin32 的一部分。这是一些 Unix 手册页；Windows 界面应该是类似的。
CRYPT(3) Linux Programmer's Manual
CRYPT(3)NAME crypt, crypt_r - password and data encryption
SYNOPSIS
#define _XOPEN_SOURCE #include <unistd.h> char *crypt(const char *key, const char *salt); char *crypt_r(const char *key, const char *salt, struct crypt_data *data);Link with -lcrypt.
DESCRIPTION
crypt() is the password encryption function. It is based on the Data Encryption Standard algorithm with variations intended (among other things) to discourage use of hardware implementations of a key search.
key is a user's typed password.
salt is a two-character string chosen from the set [a–zA–Z0–9./]. This string is used to perturb the algorithm in one of 4096 different ways.
By taking the lowest 7 bits of each of the first eight characters of the key, a 56-bit key is obtained. This 56-bit key is used to encrypt repeatedly a constant string (usually a string consisting of all zeros). The returned value points to the encrypted password, a series of 13 printable ASCII characters (the first two characters represent the salt itself). The return value points to static data whose content is overwritten by each call.
Warning: The key space consists of 2**56 equal 7.2e16 possible values. Exhaustive searches of this key space are possible using massively par‐ allel computers. Software, such as crack(1), is available which will search the portion of this key space that is generally used by humans for passwords. Hence, password selection should, at minimum, avoid common words and names. The use of a passwd(1) program that checks for crackable passwords during the selection process is recommended.
The DES algorithm itself has a few quirks which make the use of the crypt() interface a very poor choice for anything other than password authentication. If you are planning on using the crypt() interface for a cryptography project, don't do it: get a good book on encryption and one of the widely available DES libraries.
CRYPT(3) Linux 程序员手册
CRYPT(3)NAME crypt, crypt_r - 密码和数据加密
概要
#define _XOPEN_SOURCE #include <unistd.h> char *crypt(const char *key, const char *salt); char *crypt_r(const char *key, const char *salt, struct crypt_data *data);与 -lcrypt 链接。
描述
crypt() 是密码加密函数。它基于数据加密标准算法，其变体旨在（除其他外）阻止使用硬件实现的密钥搜索。
key 是用户输入的密码。
salt 是从 [a–zA–Z0–9./] 集合中选择的两个字符的字符串。该字符串用于以 4096 种不同方式之一扰乱算法。
通过取密钥的前八个字符中每个字符的最低 7 位，得到一个 56 位的密钥。这个 56 位密钥用于重复加密一个常量字符串（通常是一个由全零组成的字符串）。返回值指向加密的密码，一系列 13 个可打印的 ASCII 字符（前两个字符代表盐本身）。返回值指向其内容被每次调用覆盖的静态数据。
警告：密钥空间由 2**56 个等于 7.2e16 的可能值组成。使用大规模并行计算机可以对这个关键空间进行详尽的搜索。可以使用诸如 crack(1) 之类的软件来搜索该密钥空间中通常由人类使用的部分以获取密码。因此，密码选择至少应避免使用常见的词和名称。建议使用 passwd(1) 程序在选择过程中检查可破解的密码。
DES 算法本身有一些怪癖，这使得 crypt() 接口的使用对于密码身份验证以外的任何事情都是一个非常糟糕的选择。如果您计划将 crypt() 接口用于加密项目，请不要这样做：获取一本关于加密的好书和一个广泛使用的 DES 库。
