Password formats: crypt(md5) vs md5sum

I had the same requirement, and this is about the only post I found about it. So, I've updated the user.module on my system, and it works now with mod_authn_dbd. I put a little extra code in to ease the transition for users - rather than have them all change their passwords at once, I put an extra loop in to accept both md5 and crypt hashes in the database. When the users change their passwords, they'll magically be able to use DAV :-)

Here's the patch:

--- user.module.md5     Fri Sep  7 14:43:34 2007
+++ user.module.crypt   Fri Sep  7 17:03:50 2007
@@ -36,7 +36,8 @@
 }
 
 /**
- * Fetch a user object.
+ * Fetch a user object. Updated to allow 2 different password-hashing schemes, useful for migrating to crypt()
+ *  for compatibility with mod_authn_dbd.
  *
  * @param $array
  *   An associative array of attributes to search for in selecting the
@@ -46,48 +47,54 @@
  *   A fully-loaded $user object upon successful user load or FALSE if user cannot be loaded.
  */
 function user_load($array = array()) {
-  // Dynamically compose a SQL query:
-  $query = array();
-  $params = array();
-
-  foreach ($array as $key => $value) {
-    if ($key == 'uid' || $key == 'status') {
-      $query[] = "$key = %d";
-      $params[] = $value;
-    }
-    else if ($key == 'pass') {
-      $query[] = "pass = '%s'";
-      $params[] = md5($value);
-    }
-    else {
-      $query[]= "LOWER($key) = LOWER('%s')";
-      $params[] = $value;
-    }
+   foreach (array("md5", "crypt") as $scheme) {
+     // Dynamically compose a SQL query:
+     $query = array();
+     $params = array();
+   
+     foreach ($array as $key => $value) {
+       if ($key == 'uid' || $key == 'status') {
+         $query[] = "$key = %d";
+         $params[] = $value;
+       }
+       else if ($key == 'pass' && $scheme == 'md5') {
+         $query[] = "pass = '%s'";
+         $params[] = md5($value);
+       }
+       else if ($key == 'pass' && $scheme == 'crypt') {
+         $query[] = "pass = '%s'";
+         $salt=substr($value,0,2);
+         $params[] = crypt($value, $salt);
+       }
+       else {
+         $query[]= "LOWER($key) = LOWER('%s')";
+         $params[] = $value;
+       }
+     }
+     
+     $result = db_query('SELECT * FROM {users} u WHERE '. implode(' AND ', $query), $params);
+   
+     if (db_num_rows($result)) {
+       $user = db_fetch_object($result);
+       $user = drupal_unpack($user);
+   
+       $user->roles = array();
+       if ($user->uid) {
+         $user->roles[DRUPAL_AUTHENTICATED_RID] = 'authenticated user';
+       }
+       else {
+         $user->roles[DRUPAL_ANONYMOUS_RID] = 'anonymous user';
+       }
+       $result = db_query('SELECT r.rid, r.name FROM {role} r INNER JOIN {users_roles} ur ON ur.rid = r.rid WHERE ur.uid = %d', $user->uid);
+       while ($role = db_fetch_object($result)) {
+         $user->roles[$role->rid] = $role->name;
+       }
+       user_module_invoke('load', $array, $user);
+       
+       return $user;
+     }
   }
-  $result = db_query('SELECT * FROM {users} u WHERE '. implode(' AND ', $query), $params);
-
-  if (db_num_rows($result)) {
-    $user = db_fetch_object($result);
-    $user = drupal_unpack($user);
-
-    $user->roles = array();
-    if ($user->uid) {
-      $user->roles[DRUPAL_AUTHENTICATED_RID] = 'authenticated user';
-    }
-    else {
-      $user->roles[DRUPAL_ANONYMOUS_RID] = 'anonymous user';
-    }
-    $result = db_query('SELECT r.rid, r.name FROM {role} r INNER JOIN {users_roles} ur ON ur.rid = r.rid WHERE ur.uid = %d', $user->uid);
-    while ($role = db_fetch_object($result)) {
-      $user->roles[$role->rid] = $role->name;
-    }
-    user_module_invoke('load', $array, $user);
-  }
-  else {
-    $user = FALSE;
-  }
-
-  return $user;
+  return FALSE;
 }
 
 /**
@@ -114,7 +121,8 @@
     foreach ($array as $key => $value) {
       if ($key == 'pass' && !empty($value)) {
         $query .= "$key = '%s', ";
-        $v[] = md5($value);
+        $salt=substr($value,0,2);
+        $v[] = crypt($value, $salt);
       }
       else if ((substr($key, 0, 4) !== 'auth') && ($key != 'pass')) {
         if (in_array($key, $user_fields)) {
@@ -172,7 +180,8 @@
       switch ($key) {
         case 'pass':
           $fields[] = $key;
-          $values[] = md5($value);
+          $salt=substr($value,0,2);
+          $values[] = crypt($value, $salt);
           $s[] = "'%s'";
           break;
         case 'uid':        case 'mode':     case 'sort':

If you're not worried about maintaining the MD5 hashes, you could forego the extra logic in user_load.

I use postfix+saslauthd+ pam_mysql and can authenticate postfix users against drupal. You need to make sure pam_mysql is compiled with md5 support, then just set:

crypt=3 md5=true

in your pam.d/smtp file.

Just created a cryptpw module which addresses this concern. It should be available at http://drupal.org/project/cryptpw once the next crontab run occurs.

The web is like usenet, but
the elephants are untrained.