pbkdf2(1000,20,sha512)$etc... in v2.22.5

[lucas]

hello one and all,

in linux/bash script code, not web2py interface, how do i take a regular string and convert it into the password that is stored in the password in the auth_user table under web2py version 2.22.5?

thank you in advance, lucas

[Jim S]

Here is what I'm using:

password = str(CRYPT(key="pbkdf2(1000,20,sha512):whatever-your-hash-string-is")(unhashed)[0])

[lucas]

but how do you generate the hash string from the regular text string?

[Jim Steil]

It should be the same as auth.settings.hmac_key, probably set in db.py

auth.settings.hmac_key = (
    "sha512:whatever-your-has-string-is"  # before define_tables()
)

--
Resources:
- http://web2py.com
- http://web2py.com/book (Documentation)
- http://github.com/web2py/web2py (Source code)
- https://code.google.com/p/web2py/issues/list (Report Issues)
---
You received this message because you are subscribed to a topic in the Google Groups "web2py-users" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/web2py/801jh-wneL0/unsubscribe.
To unsubscribe from this group and all its topics, send an email to web2py+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/web2py/2b0bd3f4-5dbc-49b5-b40e-e50e616b9d1dn%40googlegroups.com.

[lucas]

ok, that sets up the web2py environment.  i'm asking how to reproduce or generate the hashed key from regular text within a separate shell script.  lucas

[Jim S]

I must be misunderstanding something, because that is what I thought I just showed.

hashed_password = str(CRYPT(key="pbkdf2(1000,20,sha512):whatever-your-hash-string-is")(plain_text_password)[0])

"whatever-your-hash-string-is needs" to be the same as what you're assigning to auth.settings.hmac_key in db.py

hashed_password should then match what is in auth_user.password

-Jim

[lucas]

ok, i am trying to understand.  i'm using web2py 2.22.5 under centos 8 in console only mode.  i searched all of my application files and there is no hint of auth.settings.hmac_key = "such and such".  when i access auth, session, request, etc., i can see an hmac_key key in auth.settings but it is None, AND i see a session changing value under session.auth with an equal value under response.  but again, that changes with each login.

i grep'd "hmac_key" under gluon and found "pbkdf2_hex" and "simple_hash" under gluon/packages/dal/pydal/validators.py, and i suspect i would access and use these functions based on previous posts asking similar questions, but i have no idea how to import them and then use them in a bash/python script file to reproduce the hash in a password field under web2py.

so i ask again: "in linux/bash script code, not web2py interface [or application], how do i take a regular string and convert it into the password that is stored in the password in the auth_user table under web2py version 2.22.5?"

lucas

[Jim S]

I think we'll need help from someone who knows more about this than I do.

-Jim