Post #3357144

2026-06-12 00:33 UTC

The options to password protect it are in the (usually /etc/radicale/)config file under [auth]. For proper security you could use type = htpasswd htpasswd_filename = /etc/radicale/users htpasswd_encryption = bcrypt then create a users file with apache tools (htpasswd -c -B users User1) or one of the million online htpasswd file creators.

Replies (2)

@Nomad@infosec.pub 2026-06-12 00:53

Don’t generate password files online,…

Open ##3357143
@lemmyvore@feddit.nl 2026-06-12 16:35

Please note that to use "bcrypt" for `htpasswd_encryption` you need the bcrypt python module installed. Some distributions of radicale (eg. some docker images) don't have it. It's fairly safe to set it to "md5" instead. It does not mean plain MD5 (one iteration), it does several hundred rounds of MD5 plus a salt. For the curious, the advantage of bcrypt over a single-iteration, fast hash like MD5 is that bcrypt lets you set the hashing effort, while MD5's goal is to do it as fast as possible. This becomes relevant when someone steals your password file and tries to brute force it by hashing a bunch of dictionary words and random strings (plus a bunch of salts) until something matches. A fast single-iteration hash like MD5 will let them do that much faster than a bcrypt hash set to a higher effort; it can mean the difference between finding a password in one week vs finding one in 100 years. That's what the hundreds-of-iterations MD5 is trying to achieve, it's a "poor man's bcrypt".

Open ##3395836