Mysql – How to encrypt the passwords of all datasets in the thesql table

encryptionMySQLSecuritysql

I am running an ProFTPD Server with a MySQL backend for user authentication.

The passwords for the users are currently in plaintext. And my goal is, that all the users have encrypted passwords stored in the database.

I know that when I want to encrypt one password from one user I can type in the SQL command: 

update users set password= md5('MyPassword') where password="myPassword";

But how can I encrypt all all passwords from all users?

I hope anyone can help me.

Best Answer

update users set password= md5('MyPassword') where password="myPassword";

It is not safe to use MD5 as a hash. MD5 is deprecated

Safe hash algorithms are PBKDF2, bcrypt, scrypt etc. And additionally all hash algorithms have to be used with salt. @Gerald Schneider posted a very good link for this topic: https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords

The problem here is, that none of these save hash algorithm are implemented in mysql. There is an authentication mode for PBKDF2 in ProFTPD in the mod sql module. But there is no way OOTB you can generate a PBKDF2 hashed password, or a password, that is hashed with another safe algorithm, in a mysql database.

A possible solution would be to create an HTML page with PHP. PHP has functions, implemented by default, for generating safe hashed passwords.

I asked in the ProFTPD forum, if anyone there knows another, maybe better answer, to the problem: https://forums.proftpd.org/smf/index.php/topic,12110.0.html

Yes, I know the original question was, how could one hash all the passwords in my database at once with one command. But I think, first, I should look for a safe hash algorithm.

Related Topic