Bug 119651

Summary:	HTTP authentication against password file with SHA1 password hashes fails
Product:	Red Hat Enterprise Linux 3	Reporter:	Espen Carlsen <escarls>
Component:	httpd	Assignee:	Joe Orton <jorton>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	3.0
Target Milestone:	---
Target Release:	---
Hardware:	i386
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2004-08-18 02:55:39 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	116727

Description Espen Carlsen 2004-04-01 04:14:39 UTC

After upgrade from Redhat 7.3 to RedHat Enterprise 3, none of the 
users can authenticate with the webserver.

Steps to reproduce:
Create htpassword file with a user and password encrypted with MD5
Try to authenticate
Authentication works
Alter encrytion of the same user to crypt
Try to authenticate
Authentication works
Alter encryption of the same user to SHA-1
Try to authenticate
Authentication fails.
Error log reports:
[Wed Mar 31 16:12:17 2004] [error] [client 192.168.66.234] user 
testuser: authentication failure for "/party/admin/new": Password 
Mismatch.

The workaround may be to convert all passwords to MD5, but since I 
don't have a list over all the users passwords this is not an option.

Comment 1 Joe Orton 2004-04-01 11:33:33 UTC

Thanks for the report.  This is a regression in 2.0, we can make fixed
packages available for testing shortly.

Comment 2 Joe Orton 2004-04-01 13:46:46 UTC

Packages which include the fix for this issue are now available for
testing purposes from: http://people.redhat.com/jorton/Taroon-httpd/.
 The fix will be included in future httpd updates for RHEL3.

Comment 3 Espen Carlsen 2004-04-01 16:49:15 UTC

The test packages sovled my problem.
Thanx!

Comment 4 Jay Turner 2004-08-18 02:55:39 UTC

Closing out based on feedback from original reporter.

Comment 5 Josh Bressers 2004-09-01 18:55:40 UTC

An errata has been issued which should help the problem 
described in this bug report. This report is therefore being 
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files, 
please follow the link below. You may reopen this bug report 
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2004-349.html