Question about a1-hash
Hello! I have written a Lua script to connect to a database and provide directory information for phones registering with FreeSWITCH. My problem is that I store an MD5 hash of the passwords in the database, so I wish there was a way to get FreeSWITCH to authenticate using the MD5 hash of the password provided by the phone, and not the password itself. According to the wiki<http://wiki.freeswitch.org/wiki/XML_User_Directory_Guide>, it is possible to pass in a parameter called *a1-hash* instead of the username and password. The a1-hash parameter is an MD5 hash of a string comprising the username, domain and password, separated by colons. Unfortunately, I can't generate that string, since I don't have the raw password, just the MD5 hash. I would have my Lua script do the authentication, but cannot because FreeSWITCH doesn't pass the user's password to the script. The best solution I can think of is to enter the MD5 hash of the password in the phone. Does anyone have a better idea? Mike van Lammeren
We don't have the password so we can't pass it to you please read: http://en.wikipedia.org/wiki/Digest_access_authentication Its how the authentication is done and we are never given the text of the password you are however given the details so you can calculate the response and verify it without having to know the password. /b On Jan 14, 2010, at 9:44 AM, Mike van Lammeren wrote:
Hello!
I have written a Lua script to connect to a database and provide directory information for phones registering with FreeSWITCH.
My problem is that I store an MD5 hash of the passwords in the database, so I wish there was a way to get FreeSWITCH to authenticate using the MD5 hash of the password provided by the phone, and not the password itself.
According to the wiki, it is possible to pass in a parameter called a1-hash instead of the username and password. The a1-hash parameter is an MD5 hash of a string comprising the username, domain and password, separated by colons. Unfortunately, I can't generate that string, since I don't have the raw password, just the MD5 hash.
I would have my Lua script do the authentication, but cannot because FreeSWITCH doesn't pass the user's password to the script.
The best solution I can think of is to enter the MD5 hash of the password in the phone.
Does anyone have a better idea?
Mike van Lammeren
That's awesome! I should have noticed those 32-character strings in the parameters passed to the script. Thanks! It's a little off-topic, but I'm glad to see someone using digest authentication. It's too bad that it was un-supported by browsers for so long, that no one touched it for web apps. The choice is either use basic authentication, which is plaintext, or switch to https. With https, not everyone realizes that the web server, and any apps, can see the password in plain text. Mike van Lammeren On Thu, Jan 14, 2010 at 11:00 AM, Brian West <brian@freeswitch.org> wrote:
We don't have the password so we can't pass it to you please read: http://en.wikipedia.org/wiki/Digest_access_authentication
Its how the authentication is done and we are never given the text of the password you are however given the details so you can calculate the response and verify it without having to know the password.
/b
On Jan 14, 2010, at 9:44 AM, Mike van Lammeren wrote:
Hello!
I have written a Lua script to connect to a database and provide directory information for phones registering with FreeSWITCH.
My problem is that I store an MD5 hash of the passwords in the database, so I wish there was a way to get FreeSWITCH to authenticate using the MD5 hash of the password provided by the phone, and not the password itself.
According to the wiki<http://wiki.freeswitch.org/wiki/XML_User_Directory_Guide>, it is possible to pass in a parameter called *a1-hash* instead of the username and password. The a1-hash parameter is an MD5 hash of a string comprising the username, domain and password, separated by colons. Unfortunately, I can't generate that string, since I don't have the raw password, just the MD5 hash.
I would have my Lua script do the authentication, but cannot because FreeSWITCH doesn't pass the user's password to the script.
The best solution I can think of is to enter the MD5 hash of the password in the phone.
Does anyone have a better idea?
Mike van Lammeren
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Why don't you just store the a1-hash in the database instead of the password? -Bill W. Mike van Lammeren wrote:
Hello!
I have written a Lua script to connect to a database and provide directory information for phones registering with FreeSWITCH.
My problem is that I store an MD5 hash of the passwords in the database, so I wish there was a way to get FreeSWITCH to authenticate using the MD5 hash of the password provided by the phone, and not the password itself.
According to the wiki <http://wiki.freeswitch.org/wiki/XML_User_Directory_Guide>, it is possible to pass in a parameter called /a1-hash/ instead of the username and password. The a1-hash parameter is an MD5 hash of a string comprising the username, domain and password, separated by colons. Unfortunately, I can't generate that string, since I don't have the raw password, just the MD5 hash.
I would have my Lua script do the authentication, but cannot because FreeSWITCH doesn't pass the user's password to the script.
The best solution I can think of is to enter the MD5 hash of the password in the phone.
Does anyone have a better idea?
Mike van Lammeren
------------------------------------------------------------------------
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hi Bill! That's a perfectly reasonable suggestion, but for this solution, I need a username/password combo that spans domains. Also, the password is used in other places too. Thanks for the reply! Mike van Lammeren On Thu, Jan 14, 2010 at 11:15 AM, Bill W <freeswitch@aastral.net> wrote:
Why don't you just store the a1-hash in the database instead of the password?
-Bill W.
Mike van Lammeren wrote:
Hello!
I have written a Lua script to connect to a database and provide directory information for phones registering with FreeSWITCH.
My problem is that I store an MD5 hash of the passwords in the database, so I wish there was a way to get FreeSWITCH to authenticate using the MD5 hash of the password provided by the phone, and not the password itself.
According to the wiki <http://wiki.freeswitch.org/wiki/XML_User_Directory_Guide>, it is possible to pass in a parameter called /a1-hash/ instead of the username and password. The a1-hash parameter is an MD5 hash of a string comprising the username, domain and password, separated by colons. Unfortunately, I can't generate that string, since I don't have the raw password, just the MD5 hash.
I would have my Lua script do the authentication, but cannot because FreeSWITCH doesn't pass the user's password to the script.
The best solution I can think of is to enter the MD5 hash of the password in the phone.
Does anyone have a better idea?
Mike van Lammeren
------------------------------------------------------------------------
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hey Mike/Brian, Okay, I'm missing something here. Sure, you can calculate the response, but how are you going to validate that against what is in the database? Thanks, Bill
You take what is in the data base and create an a1-hash if you have the parts to create it.. if not your SOL. /b On Jan 14, 2010, at 11:20 AM, Bill W wrote:
Hey Mike/Brian,
Okay, I'm missing something here. Sure, you can calculate the response, but how are you going to validate that against what is in the database?
Thanks, Bill
Ah okay, it is just as I thought. Either I store the a1-hash in the database, or store the password in clear text so I can calculate a1-hash on the fly. Or as Mike says, have the phone password be the actual hash value of the password in the database, and then calculate an a1-hash with that hashed password. Thanks, Bill W. Brian West wrote:
You take what is in the data base and create an a1-hash if you have the parts to create it.. if not your SOL.
/b
On Jan 14, 2010, at 11:20 AM, Bill W wrote:
Oh, I still have to go with my solution of using the MD5 hash of the password for the phones. Since I cannot change the database for other reasons, I am still unable to generate the a1-hash. Like FreeSWITCH, my script doesn't know the password either! All the same, I'm glad that FreeSWITCH uses digest authentication. It is a good way to implement authentication. Mike van Lammeren On Thu, Jan 14, 2010 at 12:20 PM, Bill W <freeswitch@aastral.net> wrote:
Hey Mike/Brian,
Okay, I'm missing something here. Sure, you can calculate the response, but how are you going to validate that against what is in the database?
Thanks, Bill
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (3)
-
Bill W
-
Brian West
-
Mike van Lammeren