I am using pure-ftpd with MariaDB to auth users. After upgrade to Debian 12 Bookworm it stopped working. Debian 12 includes new pure-ftpd 1.0.50, which has introduced the following change:
Support for MD5, SHA1 and the MySQL PASSWORD() function were removed for password hashing. You should now use scrypt, argon2 or the system crypt(3) function.
So I updated /etc/pure-ftpd/db/mysql.conf to reflect the changes (before I used md5):
# Mandatory : how passwords are stored
# Valid values are : "cleartext", "argon2", "scrypt", "crypt", and "any"
MYSQLCrypt crypt
I tried to generate hash with the following one-liner:
python3 -c 'import sys, crypt, getpass; print(crypt.crypt(getpass.getpass("Password: "), crypt.METHOD_SHA512))'
For example, for password "test" I get "$6$98sU0xdVjMC7CQk0$f5548Rnp4FBkF0lxHfU3P1Jpa0Y0ZtWg7BvNoeA91/U05gPnVi3yf1XRBuedwcYRk5YnFRdhn6/bZQm0xsKkW0". I put the result of this function to the database, but it still tells me "Login authentication failed":
220 You will be disconnected after 15 minutes of inactivity.
331 User xxx OK. Password required
Password:
530 Login authentication failed
ftp: Login failed
ftp> exit
I tried to turn on verbose output, but no more information is provided.
Has anyone managed to get working pure-ftpd 1.0.50 with MariaDB/MySQL?
When I try MYSQLCrypt cleartext
, than it works fine, but I don't consider it as a best option to store passwords in cleartext.