title: Storing passwords securely in MySQL, but still accessible by PAM
body: <p>We have a PHP application that stores passwords just using the MD5 function (with no salt).<br>
  We have OpenSSH set to use <a href="http://pam-mysql.sourceforge.net" rel="nofollow">pam-mysql</a> to authenticate users from the same database.  </p>
  
  <p>We would like to switch to use hashed passwords and we are considering either: 1. doing it ourselves, (something like <code>md5($salt."$".$password)</code> or <code>hash("sha256", $salt."$".$password)</code>), or 2. using php's crypt function (which uses the OS crypt(3) if available).<br>
  The problem is that I have not found whether pam-mysql supports crypt(3) or any replacement pam module that does.  </p>
  
  <p><code>crpyt(3)</code> uses a user supplied algorithm and salt: <code>crypt('password', '$5$saltstring$')</code> for <code>sha256</code> which returns <code>$5$saltstring$OH4IDuTlsuTYPdED1gsuiRMyTAwNlRWyA6Xr3I4/dQ5</code>. Any language that uses the <code>crypt(3)</code> library will see that string and know to use <code>sha256</code> with the given hash and expect the given result.</p>
  
  <p>Is the first method sufficient or is there some PAM module out there that supports MySQL and crypt(3)?</p>