Bug 119651 - HTTP authentication against password file with SHA1 password hashes fails
Summary: HTTP authentication against password file with SHA1 password hashes fails
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 3
Classification: Red Hat
Component: httpd
Version: 3.0
Hardware: i386
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Joe Orton
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 116727
TreeView+ depends on / blocked
 
Reported: 2004-04-01 04:14 UTC by Espen Carlsen
Modified: 2007-11-30 22:07 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2004-08-18 02:55:39 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2004:349 0 normal SHIPPED_LIVE Important: httpd security update 2004-09-01 04:00:00 UTC

Description Espen Carlsen 2004-04-01 04:14:39 UTC
After upgrade from Redhat 7.3 to RedHat Enterprise 3, none of the 
users can authenticate with the webserver.

Steps to reproduce:
Create htpassword file with a user and password encrypted with MD5
Try to authenticate
Authentication works
Alter encrytion of the same user to crypt
Try to authenticate
Authentication works
Alter encryption of the same user to SHA-1
Try to authenticate
Authentication fails.
Error log reports:
[Wed Mar 31 16:12:17 2004] [error] [client 192.168.66.234] user 
testuser: authentication failure for "/party/admin/new": Password 
Mismatch.

The workaround may be to convert all passwords to MD5, but since I 
don't have a list over all the users passwords this is not an option.

Comment 1 Joe Orton 2004-04-01 11:33:33 UTC
Thanks for the report.  This is a regression in 2.0, we can make fixed
packages available for testing shortly.

Comment 2 Joe Orton 2004-04-01 13:46:46 UTC
Packages which include the fix for this issue are now available for
testing purposes from: http://people.redhat.com/jorton/Taroon-httpd/.
 The fix will be included in future httpd updates for RHEL3.

Comment 3 Espen Carlsen 2004-04-01 16:49:15 UTC
The test packages sovled my problem.
Thanx!

Comment 4 Jay Turner 2004-08-18 02:55:39 UTC
Closing out based on feedback from original reporter.

Comment 5 Josh Bressers 2004-09-01 18:55:40 UTC
An errata has been issued which should help the problem 
described in this bug report. This report is therefore being 
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files, 
please follow the link below. You may reopen this bug report 
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2004-349.html



Note You need to log in before you can comment on or make changes to this bug.