I've been tasked with deploying a FTP instance with a MySQL backend for storing user logins.
Looking online I found Pure-FTPD, which on paper is great. However documentation states it only allows these hashing / encryption options for passwords:
#MYSQLCrypt md5, cleartext, crypt() or password()
MD5 and cleartext fall outside the requirements, password() should apparently be avoided (according to MySQL documentation) which leaves crypt().
Usage of crypt() to insert a value into a database relies on 'encrypt', which in turn is a crypt() system call. See: https://dev.mysql.com/doc/refman/5.5/en/encryption-functions.html#function_encrypt
So come's the question, how secure is this encryption method to actually store sensitive data, wikipedia states that crypt() -
"Rather than encrypting the password with a key, which would have allowed the password to be recovered from the encrypted value and the key, it used the password itself as a key, and the password database contained the result of encrypting the password with this key."
Which seems great, however I can't seem to find any info on this 'password' database it speaks of, the inserted value also are stripped down to a max of 16 bits if I recall correctly, which really doesn't seem secure.
Any input on this would be appreciated, thanks!