Hash passwords using the system default algorithm

* Recent RHEL distributions use yescrypt isntead of SHA-512.
* MD5 is obsolete, don't even mention it.

Signed-off-by: Dimitri Papadopoulos <3350651-DimitriPapadopoulos@users.noreply.gitlab.com>

NEWS

@@ -6,6 +6,7 @@
   now causes session rejection (previously silently ignored).
 - In certificate authentication the user is not prompted for group selection
   if the certificate provides a single group (#692)
+- ocpasswd: Use the system default hash algorithm to hash ocserv passwords.
 
 
 * Version 1.5.0 (released 2026-06-07)

meson.build

@@ -318,7 +318,7 @@ endforeach
 
 # Header checks
 check_headers = [
-  'net/if_tun.h', 'linux/if_tun.h', 'netinet/in_systm.h', 'crypt.h',
+  'net/if_tun.h', 'linux/if_tun.h', 'netinet/in_systm.h',
   'linux/net_tstamp.h', 'linux/netlink.h', 'linux/rtnetlink.h',
   'linux/sock_diag.h', 'linux/unix_diag.h',
 ]

src/auth/plain.c

@@ -33,11 +33,7 @@
 #ifdef HAVE_LIBOATH
 #include <liboath/oath.h>
 #endif
-#ifdef HAVE_CRYPT_H
-/* libcrypt in Fedora28 does not provide prototype
-   * in unistd.h */
 #include <crypt.h>
-#endif
 #include "log.h"
 
 #define MAX_CPASS_SIZE 128

src/ocpasswd/ocpasswd.c

@@ -29,27 +29,17 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <getopt.h>
-#ifdef HAVE_CRYPT_H
-/* libcrypt in Fedora28 does not provide prototype
-   * in unistd.h */
 #include <crypt.h>
-#endif
 #include <locale.h>
 
 #define DEFAULT_OCPASSWD "/etc/ocserv/ocpasswd"
 
-static const char alphabet[] =
-	"0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ./";
-
 #define SALT_SIZE 16
 static void crypt_int(const char *fpasswd, const char *username,
 		      const char *groupname, const char *passwd)
 {
-	uint8_t _salt[SALT_SIZE];
-	char salt[SALT_SIZE + 16];
-	char *p, *cr_passwd;
+	char *cr_salt, *cr_passwd;
 	char *tmp_passwd;
-	unsigned int i;
 	unsigned int fpasswd_len = strlen(fpasswd);
 	unsigned int tmp_passwd_len;
 	unsigned int username_len = strlen(username);
@@ -63,36 +53,16 @@ static void crypt_int(const char *fpasswd, const char *username,
 	setlocale(LC_CTYPE, "C");
 	setlocale(LC_COLLATE, "C");
 
-	ret = gnutls_rnd(GNUTLS_RND_NONCE, _salt, sizeof(_salt));
-	if (ret < 0) {
-		fprintf(stderr, "Error generating nonce: %s\n",
-			gnutls_strerror(ret));
+	/* Generate salt using the system default algorithm */
+	cr_salt = crypt_gensalt(NULL, 0, NULL, 0);
+	if (cr_salt == NULL) {
+		perror("Error in crypt_gensalt()");
 		exit(EXIT_FAILURE);
 	}
 
-#ifdef TRY_SHA2_CRYPT
-	strcpy(salt, "$5$");
-#else
-	strcpy(salt, "$1$");
-#endif
-	p = salt + 3;
-
-	for (i = 0; i < sizeof(_salt); i++) {
-		*p = alphabet[_salt[i] % (sizeof(alphabet) - 1)];
-		p++;
-	}
-	*p = '$';
-	p++;
-	*p = 0;
-	p++;
-
-	cr_passwd = crypt(passwd, salt);
-	if (cr_passwd == NULL) { /* try MD5 */
-		salt[1] = '1';
-		cr_passwd = crypt(passwd, salt);
-	}
+	cr_passwd = crypt(passwd, cr_salt);
 	if (cr_passwd == NULL) {
-		fprintf(stderr, "Error in crypt().\n");
+		perror("Error in crypt()");
 		exit(EXIT_FAILURE);
 	}
 
@@ -122,7 +92,7 @@ static void crypt_int(const char *fpasswd, const char *username,
 		int found = 0;
 
 		while ((len = getline(&line, &line_size, fd)) > 0) {
-			p = strchr(line, ':');
+			char *p = strchr(line, ':');
 			if (p == NULL)
 				continue;