Changeset ec0355f

Timestamp:

2008-03-16T16:31:27Z (17 years ago)

Author:

Wilmer van der Gaast <wilmer@…>

Branches:

master

Children:

c029350

Parents:

4e8db1c

Message:

Passwords in bitlbee.conf can now be (properly salted) MD5 hashes, for
just that little bit extra security.

Files:

• bitlbee.conf (modified) (2 diffs)
• doc/CHANGES (modified) (1 diff)
• irc_commands.c (modified) (2 diffs)

bitlbee.conf

@@ -49 +49 @@
 ##
 ## Password the user should enter when logging into a closed BitlBee server.
+## You can also have an MD5-encrypted password here. Format: "md5:", followed
+## by a hash as generated for the <user password=""> attribute in a BitlBee
+## XML file (for now there's no easier way to generate the hash).
 ##
 # AuthPassword = ItllBeBitlBee   ## Heh.. Our slogan. ;-)
+## or
+# AuthPassword = md5:gzkK0Ox/1xh+1XTsQjXxBJ571Vgl
 
 ## OperPassword
@@ -57 +62 @@
 ##
 # OperPassword = ChangeMe!
+## or
+# OperPassword = md5:I0mnZbn1t4R731zzRdDN2/pK7lRX
 
 ## HostName

doc/CHANGES

@@ -28 +28 @@
   user is asked to resolve this before continuing. Also, UTF-8 is the default
   setting now, since that's how the world seems to work these days.
+- One can now keep hashed passwords in bitlbee.conf instead of the cleartext
+  version.
 - Most important change: New file format for user data (accounts, nicks and
   settings). Migration to the new format should happen transparently,

irc_commands.c

@@ -30 +30 @@
 static void irc_cmd_pass( irc_t *irc, char **cmd )
 {
-        if( global.conf->auth_pass && strcmp( cmd[1], global.conf->auth_pass ) == 0 )
+        if( global.conf->auth_pass &&
+            strncmp( global.conf->auth_pass, "md5:", 4 ) == 0 ?
+              md5_verify_password( cmd[1], global.conf->auth_pass + 4 ) == 0 :
+              strcmp( cmd[1], global.conf->auth_pass ) == 0 )
         {
                 irc->status |= USTATUS_AUTHORIZED;
@@ -88 +91 @@
 static void irc_cmd_oper( irc_t *irc, char **cmd )
 {
-        if( global.conf->oper_pass && strcmp( cmd[2], global.conf->oper_pass ) == 0 )
+        if( global.conf->oper_pass &&
+            strncmp( global.conf->oper_pass, "md5:", 4 ) == 0 ?
+              md5_verify_password( cmd[2], global.conf->oper_pass + 4 ) == 0 :
+              strcmp( cmd[2], global.conf->oper_pass ) == 0 )
         {
                 irc_umode_set( irc, "+o", 1 );