This is what I see in hudson/users/me/config.xml
:
[...]
<hudson.security.HudsonPrivateSecurityRealm_-Details>
<passwordHash>mEDUyJ:0c9e6f2556b9b3a0b9e9046c21490422b4a54877f057b527b2c0bd4dc83342d5</passwordHash>
</hudson.security.HudsonPrivateSecurityRealm_-Details>
[...]
What is the algorithm (if SHA1, than what is the mEDUyJ
prefix)? How can I get this hash in PHP, for example?
The source code responsible for this is found in the hudson.security.HudsonPrivateSecurityRealm
class (more specifically, the PasswordEncoder
inner class).
Consider your example:
mEDUyJ:0c9e6f2556b9b3a0b9e9046c21490422b4a54877f057b527b2c0bd4dc83342d5
The prefix (mEDUyJ
) is actually a six-letter salt. A salt can be any six-letter permutation of uppercase letters and lowercase letters.
Hudson uses the Acegi Security library. More specifically, it uses that library's ShaPasswordEncoder
class. It's basically doing this:
String salt = generateSomeSixLetterSalt() // Fictional function
String passwordHash = salt + ":" + new ShaPasswordEncoder(256).encodePassword(password, salt);
Once you view the source code for ShaPasswordEncoder
, you find this it's essentially doing this:
// Fictional functions ahead...
String salt = generateSomeSixLetterSalt()
String passwordHash = salt + ":" + hex_encode(sha256_hash(utf8_encode(password + "{" + salt + "}")))
来源:https://stackoverflow.com/questions/4358146/what-password-encryption-hudson-is-using