Re: [Proftpd-user] GETTING SALT VALUE IMPLICITLY

On 02.07.20 13:02, Onur GURSOY wrote:
>Nowadays, I have working on sftp authentication over sqlite db on proftpd.
>I have access succesfully with my sqlite users.
>Sqlite users has salted hashed password.
>In that point, i have to give salt value to proftpd.
>Currently, i store salt value in the db as a clear text.
>But I don't want anyone to see my salt value.
>How can i do this ?
>How can i hide my salt value ?

if you mean the salt used for password hashing, it's used to prevent users with the same
password from having same password hash.
The salt is stored as part of encryptec/hashed password, so you don't keep
it separate. Also, You don't need to hide it more than hide hashed passwords
- nobody should be able to read either.

So, there's no point in hiding salt.

-- 
Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Support bacteria - they're the only culture some people have.


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html