Hudson使用什么密码加密？

Question

这就是我所看到的hudson/users/me/config.xml:

[...]
<hudson.security.HudsonPrivateSecurityRealm_-Details>
  <passwordHash>mEDUyJ:0c9e6f2556b9b3a0b9e9046c21490422b4a54877f057b527b2c0bd4dc83342d5</passwordHash>
</hudson.security.HudsonPrivateSecurityRealm_-Details>
[...]

什么是算法(如果是SHA1,那么mEDUyJ前缀是什么)？例如,我如何在PHP中获取此哈希？

Answer 1

负责此的源代码可在hudson.security.HudsonPrivateSecurityRealm类中找到(更具体地说,PasswordEncoder内部类).

考虑你的例子:

mEDUyJ:0c9e6f2556b9b3a0b9e9046c21490422b4a54877f057b527b2c0bd4dc83342d5

prefix(mEDUyJ)实际上是一个六个字母的盐.盐可以是大写字母和小写字母的任意六个字母的排列.

Hudson使用Acegi Security库.更具体地说,它使用该库的ShaPasswordEncoder类.它基本上是这样做的:

String salt = generateSomeSixLetterSalt() // Fictional function
String passwordHash = salt + ":" + new ShaPasswordEncoder(256).encodePassword(password, salt);

查看源代码后ShaPasswordEncoder,您会发现它基本上是这样做的:

// Fictional functions ahead...
String salt = generateSomeSixLetterSalt()
String passwordHash = salt + ":" + hex_encode(sha256_hash(utf8_encode(password + "{" + salt + "}")))