INNER CODE UNIT · Python
hash_password
kejilion/sh · site_access_accounts.py:10
def hash_password(password: str) -> str:
if not isinstance(password, str):
raise ConfigError('invalid password')
raw = password.encode('utf-8')
# openssl passwd -apr1 silently truncates stdin passwords after 256 bytes.
if not raw or len(raw) > 256 or any(char in raw for char in (b'\x00', b'\r', b'\n')):
raise ConfigError('invalid password')
try:
result = subprocess.run(['/usr/bin/openssl', 'passwd', '-apr1', '-stdin'],
input=raw + b'\n', stdout=subprocess.PIPE, stderr=subprocess.DEVNULL,
env={'PATH': '/usr/bin:/bin', 'LC_ALL': 'C'},
timeout=10, check=True)
except (OSError, subprocess.SubprocessError) as exc:
raise ConfigError('password hashing unavailable') from exc
try:
return result.stdout.decode('ascii').strip()
except UnicodeDecodeError as exc:
raise ConfigError('password hashing failed') from exc