How can ProFTPD read a password encrypted with the MySQL ENCRYPT() function?

Question

I have set up ProFTPD so that it uses the `mod_sql_mysql` backend. Everything works fine up until I inserted the users in the SQL database. I used the following query to do so: ``` INSERT INTO `auth`.`users` (`userid`, `passwd`, `uid`, `gid`, `homedir`, `shell`) VALUES ('username', ENCRYPT('bluefish'), '999', '999', '/dev/zero', '/bin/laden'); ``` I can login into my account just fine, but I really don't understand how ProFTPD reads the encrypted password `"bluefish"` as MySQL uses a random salt if there's no salt provided. That should lead to a different output of `ENCRYPT('bluefish')` everytime ProFTPD uses the MySQL backend to check if the password matches one entry in the database. It works just fine though. How can ProFTPD know what salt has been used?

Accepted Answer

ProFTPD does not need to know what the salt is.

Per the MySQL documentation, `ENCRYPT` uses the Unix `crypt()` implementation of DES. As you pointed out, if no salt is provided, a random salt is chosen. According to the man pages:

The returned value points to the encrypted password, a series of 13 printable ASCII characters (the first two characters represent the salt itself).

You can verify this for yourself, by running e.g.:

```
SELECT ENCRYPT ('blowfish');
```

which returns:

```
201GDb8Aj8RGU
```

If you then run

```
select ENCRYPT ('blowfish', '201GDb8Aj8RGU');
```

You'll get the same result `201GDb8Aj8RGU`. Only the first two characters are used as salt.

It becomes a little clearer if you provide your own salt, such as :

```
SELECT ENCRYPT ('blowfish', 'rb');
```

The returned value is:

```
rbMle0EHJVXcI
^^
```

Your provided salt is now much more evident.

How can ProFTPD read a password encrypted with the MySQL ENCRYPT() function?

Solution

Problem