mod_auth_mysql and phpass

19 May

With the release of WordPress 2.5, there were some significant changes to the way passwords were stored in the database.  Prior to 2.5, passwords were stored as MD5 hashes.  While simple and easy, there were some security implications, so since 2.5, passwords are now salted and hashed using the phpass encryption library.  At Automattic we like to keep things simple, so we use the WordPress and bbPress user system for external authentication for things such as Trac and Subversion.  This allows us an effective and simple single sign on (SSO) solution for almost everything we do.  Unfortunately, the existing mod_auth_mysql apache module did not have support for the new password format.

Thanks to Nikolay, we now have the best of both worlds.  He has patched mod_auth_mysql to support phpass.  This means you can now have plug and play authentication against your WordPress blog or bbPress forum almost anywhere you can think of.  The patch allows automatic fallback to MD5 in case the user has not yet logged into WordPress and their password is still stored in the old format.  

Once the new module is loaded, you will just need to replace the following line in your apache configuration file.

OLD:AuthMySQLPwEncryption md5
NEW:AuthMySQLPwEncryption phpass

You can download the patched version here. It has been tested with Apache 2.2.3 and MySQL 4.1/5.0

25 Responses to “mod_auth_mysql and phpass”

  1. Beau May 19, 2008 at 2:40 pm #

    2 words: bad ass.

  2. James May 19, 2008 at 4:26 pm #

    I wrote the patch that added phpass to WordPress and this is pretty cool news. Always good to see more support.

  3. Oyvind May 20, 2008 at 4:01 am #

    Nice, I was just thinking about how to integrate Trac/SVN/BBpress/Wordpress on one site. Having a single sign on will be a killer feature for this setup.

    Do you have a short howto or description of how this is configured for the different components?

  4. chewy22222003 May 20, 2008 at 10:52 am #

    Is there also a patch for Nginx, or will it use the Apache mod_auth_mysql module?

  5. Dave Coveney May 21, 2008 at 10:07 am #

    Damn – another thing to play with instead of doing the work I’m supposed to be doing!

  6. trance May 28, 2008 at 1:28 pm #

    interestingly!

  7. Jud June 26, 2008 at 6:12 pm #

    This is awesome indeed — how about a Win32 build?

  8. space man August 1, 2008 at 1:04 pm #

    Always good to see more support:)thanks for info:)

  9. IgoruS August 15, 2008 at 3:57 am #

    Hi.
    Interesting article.
    Thank you
    And how to subscribe to RSS?

  10. serfman August 18, 2008 at 5:38 pm #

    Is there also a patch for Nginx, or will it use the Apache mod_auth_mysql module?

  11. Alex September 15, 2008 at 2:45 pm #

    very interesting
    thanx

  12. Joe Jacobs January 17, 2009 at 9:32 pm #

    is it possible to use this with litespeed? you guys use litespeed right?

  13. Barry January 19, 2009 at 8:03 pm #

    Unfortunately not possible at this time. We are working on Nginx integration now. Once its complete, I will announce it on my blog. We are moving away from Litespeed.

  14. amfetamin March 15, 2009 at 12:50 pm #

    тук тук, кто по русски понимать?
    how can i “make” this patched mod auth mysql on freebsd 7.1 ? Im not strong in code && english too =(
    mb u make an bsd port? it will be nice =)

  15. Rohan Kapoor September 26, 2009 at 8:17 pm #

    Hi. I’m trying to get this to work on wordpress mu 2.8.4 and CENTOS 5.3. The module won’t compile. Can you help?

  16. karachoooo October 7, 2009 at 2:37 pm #

    Upstream?

Trackbacks/Pingbacks

  1. Ma.tt » WordPress + mod_auth_mysql - May 19, 2008

    [...] mod_auth_mysql and phpass [...]

  2. JERSEY-BARKER » Blog Archive » Matt: WordPress + mod_auth_mysql - May 19, 2008

    [...] mod_auth_mysql and phpass, a new patch that allows Apache authentication (for Subversion, Trac, enterprise integration systems) to work with the new WordPress secure password storage. Powered by Bookmarkify™ Tags: word press [...]

  3. WordPress Wednesday News: WordCamps Everywhere, Apache Patch for Securer Passwords, WordPress Plugin Contest, and More WordPress News : The Blog Herald - May 21, 2008

    [...] Patch: Barry Abramson writes about mod_auth_mysql and phpass, a new patch for Apache authentication which works with the new WordPress secure password storage [...]

  4. WordPress Wednesday News: WordCamps Everywhere, Apache Patch for Securer Passwords, WordPress Plugin Contest, and More WordPress News | Writing & Blogging Info - May 23, 2008

    [...] Patch: Barry Abramson writes about mod_auth_mysql and phpass, a new patch for Apache authentication which works with the new WordPress secure password storage [...]

  5. Scott Jarkoff :: mod_auth_mysql and phpass - May 27, 2008

    [...] mod_auth_mysql and phpass Keep things simple with WordPress and bbPress by using a simple single sign on (SSO) solution which authenticates users against the WordPress user system. This updated mod_auth_mysql apache module has support for the new WordPress password format. [...]

  6. WordPress Wednesday News: WordPress 5 Years Old, WordCamps International, WordPress 2.6 On Track, Plugin Competition is Hot, Genko Updated : The Blog Herald - May 28, 2008

    [...] Secure Storage: Barry Abramson writes about mod_auth_mysql and phpass, a new patch for Apache authentication which works with the new WordPress secure password storage [...]

  7. Colin Charles Agenda » Blog Archive » mod_auth_mysql patched to work with phpass - June 1, 2008

    [...] so, the nice folk at Automattic (makers of fine blogging software like WordPress) have released a patched version that works with [...]

  8. J’s blog » Blog Archive » Catching up again… - June 8, 2008

    [...] mod_auth_mysql and phpass « Barry on WordPress [...]

  9. Magoo - Authenticating svn and trac with wordpress - May 7, 2009

    [...] could be exploited. Searching around some more I found the awesome work of Nikolay. given out on Barry’s blog, and explaining the install process.  Nikolay made an apache module to compile that added in [...]

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Follow

Get every new post delivered to your Inbox.

Join 856 other followers

%d bloggers like this: