ModuleNotFoundError: No module named 'crypt'

[ondrejj]

Hello. In python 3.13, crypt module has been removeed. In python 3.12 it's deprecated.

Traceback (most recent call last):                                              
  File "/builddir/build/BUILD/python-repoze-who-3.0.0-build/repoze.who-3.0.0/rep
oze/who/plugins/tests/test_htpasswd.py", line 116, in test_crypt_check          
    from crypt import crypt                                                     
ModuleNotFoundError: No module named 'crypt'

[mauritsvanrees]

@ondrejj I made a PR to fix this:
#45

I thought I had write access to this repo, but apparently not, so I did it on a fork.

[tseaver]

We need to actually replace the use of crypt, at least as an option, and suggest that option in the example middleware config.

[tseaver]

Per this Apache 2.4 docs, we should likely be adding support for passwords encrypted using brcrypt's Blowfish algorithm. Candidates:

• https://pypi.org/project/blowfish/ (not intended for password hashing)
• https://pypi.org/project/bcrypt/ (I can't tell at the moment whether it can be used to check Passwords encrypted via Apache's htpasswd -nbB.

bcrypt seems to work, e.g.:

$ htpasswd -nbB myName myPassword
myName:$2y$05$yJ9mSHNyzoKAgMEW3sxvau4iXu1h94b37HXwPD.ceGhst1ZirWp2y

>>> import bcrypt
>>> pw = b"myPassword"
>>> hashed = b"$2y$05$yJ9mSHNyzoKAgMEW3sxvau4iXu1h94b37HXwPD.ceGhst1ZirWp2y"
>>> bcrypt.checkpw(pw, hashed)
True