passlib.hash.unix_disabled - Unix Disabled Account Helper¶

This class does not provide an encryption scheme, but instead provides a helper for handling disabled password fields as found in unix /etc/shadow files. This class is mainly useful only for plugging into a CryptContext instance. It can be used directly as follows:

from passlib.hash import unix_disabled

# 'hashing' a password always results in "!" or "*"
print(unix_disabled.hash("password"))
# > '!'

# verifying will fail for all passwords and hashes
print(unix_disabled.verify("password", "!"))
# > False
print(unix_disabled.verify("letmein", "*NOPASSWORD*"))
# > False

# this class should identify all strings which aren't
# valid Unix crypt() output, while leaving MCF hashes alone
print(unix_disabled.identify("!"))
# > True
print(unix_disabled.identify(""))
# > True
print(unix_disabled.identify("$1$somehash"))
# > False

Interface¶

unix_disabled ¶

This class provides disabled password behavior for unix shadow files, and follows the :ref:password-hash-api.

This class does not implement a hash, but instead matches the "disabled account" strings found in /etc/shadow on most Unix variants. "encrypting" a password will simply return the disabled account marker. It will reject all passwords, no matter the hash string. The :meth:~passlib.ifc.PasswordHash.hash method supports one optional keyword:

Parameters:

marker (str) –
Optional marker string which overrides the platform default used to indicate a disabled account.
```
If not specified, this will default to ``"*"`` on BSD systems,
and use the Linux default ``"!"`` for all other platforms.
(:attr:`!unix_disabled.default_marker` will contain the default value)
```
.. versionadded:: 1.6 This class was added as a replacement for the now-removed :class:!unix_fallback class.

encrypt `classmethod` ¶

encrypt(*args, **kwds)

Legacy alias for :meth:hash.

.. deprecated:: 1.7 This method was renamed to :meth:!hash in version 1.7. This alias will be removed in version 2.0, and should only be used for compatibility with Passlib 1.3 - 1.6.

needs_update `classmethod` ¶

needs_update(hash, secret=None)

check if hash's configuration is outside desired bounds, or contains some other internal option which requires updating the password hash.

Parameters:

hash –

hash string to examine
secret –

optional secret known to have verified against the provided hash. (this is used by some hashes to detect legacy algorithm mistakes).

Returns:

–

whether secret needs re-hashing.

.. versionadded:: 1.7

genconfig `classmethod` ¶

genconfig(**setting_kwds)

compile settings into a configuration string for genhash()

.. deprecated:: 1.7

As of 1.7, this method is deprecated, and slated for complete removal in Passlib 2.0.

For all known real-world uses, hashing a constant string
should provide equivalent functionality.

This deprecation may be reversed if a use-case presents itself in the mean time.

Deviations¶

According to the Linux shadow man page, an empty string is treated as a wildcard by Linux, allowing all passwords. For security purposes, this behavior is NOT supported; empty strings are treated the same as ! or *.