Eugeny/ajenti — pull request #45 by Ivoz (2012-09-14 19:50:00+00:00)
Title: Implement salted hashing using passlib

Should fix https://bugs.launchpad.net/ajenti/+bug/1048313

Default admin `{SHA}` hash has been left in `ajenti.conf`, however this will be changed if admin password is changed. I did not know the admin password that hash represents.

Old `{SHA}` hashes are still supported, but new users will use sha512_crypt, which is a salted PBKDF originally used for unix user accounts.

Challenge-response mechanism was removed to support this, as it would require implementing whichever new PBKDF was chosen in javascript again, and is insecure anyway, since it can be MITMed. Users wishing secure their login should use https on the server.

If this patch is accepted, would recommend:
- Updating the hardcoded admin hash in ajenti.conf
- Updating documentation to ask users to use https in order to secure their login/session/server.
- sha1.js and base64.js no longer needed, wasn't sure where they are included

I also added a `requirements.txt`, this is very useful if using python's pip installation, and/or virtualenv in development. It simply lists the necessary python packages for the project. AFAIK, passlib could also be specified in setup.py

Thanks