Score:0

PureFTPD 1.0.50 with MariaDB fails to auth, possible reason wrong hash

jp flag

I am using pure-ftpd with MariaDB to auth users. After upgrade to Debian 12 Bookworm it stopped working. Debian 12 includes new pure-ftpd 1.0.50, which has introduced the following change:

Support for MD5, SHA1 and the MySQL PASSWORD() function were removed for password hashing. You should now use scrypt, argon2 or the system crypt(3) function.

So I updated /etc/pure-ftpd/db/mysql.conf to reflect the changes (before I used md5):

# Mandatory : how passwords are stored
# Valid values are : "cleartext", "argon2", "scrypt", "crypt", and "any"
MYSQLCrypt      crypt

I tried to generate hash with the following one-liner:

python3 -c 'import sys, crypt, getpass; print(crypt.crypt(getpass.getpass("Password: "), crypt.METHOD_SHA512))'

For example, for password "test" I get "$6$98sU0xdVjMC7CQk0$f5548Rnp4FBkF0lxHfU3P1Jpa0Y0ZtWg7BvNoeA91/U05gPnVi3yf1XRBuedwcYRk5YnFRdhn6/bZQm0xsKkW0". I put the result of this function to the database, but it still tells me "Login authentication failed":

220 You will be disconnected after 15 minutes of inactivity.
331 User xxx OK. Password required
Password: 
530 Login authentication failed
ftp: Login failed
ftp> exit

I tried to turn on verbose output, but no more information is provided. Has anyone managed to get working pure-ftpd 1.0.50 with MariaDB/MySQL? When I try MYSQLCrypt cleartext, than it works fine, but I don't consider it as a best option to store passwords in cleartext.

Score:0
nr flag

I had exactly same problem yesterday when upgraded from ubuntu server 20.04 to 22.04. Changed md5 to crypt as advised in accepted answer here:

Pure-ftpd with MySQL - Crypt() not logging me in with hashed passwords

I also had to recover user passwords, as some MD5 were not easy to decrypt with this command:

sudo tcpdump -l -i enp2s0 -f "port 21" | grep -i PASS --line-buffered > recoveredFTPpasswords.txt
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.