GEN-AUTH(1)

📦
version 2.1.28 · 4 versions
, in debian bookworm

✨ GEN-AUTH(1) ✨

okay bestie, welcome to gen-auth 💖 this is the manual page for it (that's the GEN-AUTH(1) situation — you found it in the User Contributed Perl Documentation corner of the man page world) and yes we are reading the whole thing together, no skimming, periodt.

🌸 NAME 🌸

gen-auth — generate various authentication strings 🎀

🦋 USAGE 🦋

gen-auth [--help|--version] | <type> ...

💅 DESCRIPTION 💅

so gen-auth is a whole tool for helping you with literally every kind of authentication / encoding / decoding / encrypting task you could possibly need 🫶 it started out as a very smtp-specific little guy, but ngl it has drifted in functionality over time and now it's doing the most (affectionate).

the program's actions are broken down into types of encoding to generate. each <type> takes its own specific args, and those arguments are expected in a specific order on the command line. anything you don't hand over on the command line? it will prompt you for it. ⭐

one genuinely iconic benefit of that: arguments that correspond to passwords will not be echoed to the terminal when they're prompted for. your secrets stay yours, no cap 🙈

👑 TYPES 👑

the program action is controlled by the first argument. the meaning of all the arguments after it is specified by this type.

🔥 PLAIN <username> <password>

this type generates a PLAIN (RFC 2595) authentication string. it takes supplemental arguments of username and password, and it generates a Base64 encoded string "\0<username>\0<password>". slay ✨

🔥 LOGIN <username> <password>

this method accepts username and password as supplemental args. it just returns each string Base64 encoded. honestly it's giving minimal advantages over using ENCODE twice 😭 but there IS one advantage: it can hide the password if you provide it on STDIN.

🔥 CRAM-MD5 <username> <password> <challenge>

CRAM-MD5 (RFC 2195) accepts three supplemental arguments. the first is the username, the second is the password, and the third is the challenge string that the server provided. that string can be either Base64 encoded or not. the RFC states that all (unencoded) challenge strings must start w/ '<', and this is what's used to decide whether the string is Base64 encoded or not.

CRAM-MD5 uses the challenge and the supplied password to generate a digest. it then returns the Base64 encoded version of the string

md5("<username> <challenge>")
⚠️ this authentication method requires the Digest::MD5 perl module to be installed.

🔥 CRAM-SHA1 <username> <password> <challenge>

this behaves the same as CRAM-MD5 but uses SHA1 digesting rather than MD5. same energy, different algorithm 💜

⚠️ this authentication method requires the Digest::SHA1 perl module to be installed.

🔥 NTLM/SPA/MSN <username> <password> <domain> <challenge>

even though it may be advertised as one of the above types, this method of authentication is referred to singularly as NTLM. it's a multi-step authentication type, so pay attention bestie 👀

the first 3 arguments must be supplied up front. they are username, password, and domain, in that order. these three strings are used to generate an "Auth Request" string. this string should be passed verbatim to the server. the server will then respond with a challenge. that challenge is the fourth argument. after receiving the server challenge, gen-auth will produce an "Auth Response". posting this response to the server completes the NTLM authentication transaction. main character energy fr fr 🌈

⚠️ this authentication method requires the Authen::NTLM perl module to be installed. check EXAMPLES for an example of this transaction.
💀 also note that 'domain' is often blank from client or ignored by server.

🔥 HTTP-BASIC <username> <password>

returns the value base64("<username>:<password>"). used for HTTP Basic authentication (RFC 2617). you use it by adding a header

Authorization: Basic <string>

to a HTTP request, where <string> is the output of this command. that's it, that's the whole vibe ✨

🔥 APOP <challenge> <password>

this implements the APOP authentication for the POP3 protocol as described in RFC 1939. <challenge> is the challenge string presented by the POP3 server in the greeting banner. <password> is the "secret" (usually a password) used to authenticate the user. this method returns a digest

md5("<challenge><password>")

this can be used to authenticate to a POP3 server in a string like "APOP <user> <digest>" where <digest> is the string generated by this command.

⚠️ APOP required the Digest::MD5 perl module.

🔥 ENCODE <string>

simply Base64 encodes a plaintext string. provided as a convenience function. cute, easy, done 🎀

🔥 DECODE <string>

decodes a Base64 encoded string. provided as a convenience function. the reverse girlies rise 🦋

🔥 MD5/MD5-HEX <string>

provides an MD5 digest of the supplied string in hex.

🔥 MD5-BASE64 <string>

provides an MD5 digest of the supplied string in Base64.

🔥 ENCRYPT <string>

returns a crypt(3) string generated from the input string.

🔥 SALTENCRYPT <string> <salt>

same as ENCRYPT but you provide the salt as the second argument. see the crypt(3) man page for details 👑

🔥 ROT13 <string>

this performs a rot13 action on <string>. this implementation only performs the action on ASCII 65-90,97-123. any other character value is left untouched. therefore this method is primarily for LOCALE=C, ASCII only. feel free to send patches if you care to have it work in another setting 🙈

🔥 ATBASH <string>

this performs an atbash action on <string>. atbash mirrors a string such that 'a'=='z', 'b'=='y', etc. see the comments on locale and character set under ROT13. 🔄

🌈 OPTIONS 🌈

  • -s — supresses echo on all input fields read from standard input. if this option is not used, echo is suppressed on fields which are known to be password fields, but this may not be secure enough. (so like… use it, bestie 💀)
  • --help — this screen.
  • --version — version info.

😭 EXAMPLES 😭

generate a PLAIN AUTH string for user 'tim', password 'tanstaaftanstaaf':

> gen-auth plain tim tanstaaftanstaaf
Auth String: AHRpbQB0YW5zdGFhZnRhbnN0YWFm

generate a CRAM-MD5 string for user 'tim', password 'tanstaaftanstaaf', challenge '<1896.697170952@postoffice.reston.mci.net>', using prompt to hide password:

> gen-auth cram-md5
username: tim
password:
challenge: PDE4OTYuNjk3MTcwOTUyQHBvc3RvZmZpY2UucmVzdG9uLm1jaS5uZXQ+
dGltIGI5MTNhNjAyYzdlZGE3YTQ5NWI0ZTZlNzMzNGQzODkw

use the DECODE method to ensure we provided the correct output in our last example:

> gen-auth decode dGltIGI5MTNhNjAyYzdlZGE3YTQ5NWI0ZTZlNzMzNGQzODkw
tim b913a602c7eda7a495b4e6e7334d3890

use the NTLM (MSN) method to authenticate to a mail server using user 'tim', password 'tanstaaftanstaaf', and domain MAIL. both the gen-auth transaction and SMTP transaction are shown to demonstrate the interaction between the two.

AUTH MSN
334 NTLM supported
TlRMTVNTUAABAAAAB7IAAAMAAwAgAAAABAAEACMAAAB0aW1NQUlM
334 TlRMTVNTUAACAAAAAAAAAAAoAAABggAA9RH5KZlXvygAAACAAAAAZL//4sQAAAAC
TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAAAwAAAABgAGAHAAAAAGAAYAdgAAAAAAAAA8AAAAAYIAAK3lcO8PldNxIrkbvgKGJRR5owQePUtYaTtLVgfQiVQBywW2yZKyp+VFGqYfgDtdEHQAaQBtAHQAaQBtAA==
235 Authentication succeeded

> gen-auth spa
username: tim
password:
domain: MAIL
Auth Request: TlRMTVNTUAABAAAAB7IAAAMAAwAgAAAABAAEACMAAAB0aW1NQUlM
challenge: TlRMTVNTUAACAAAAAAAAAAAoAAABggAA9RH5KZlXvygAAACAAAAAZL//4sQAAAAC
Auth Response: TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAAAwAAAABgAGAHAAAAAGAAYAdgAAAAAAAAA8AAAAAYIAAK3lcO8PldNxIrkbvgKGJRR5owQePUtYaTtLVgfQiVQBywW2yZKyp+VFGqYfgDtdEHQAaQBtAHQAaQBtAA==

💖 REQUIRES 💖

  • MIME::Base64 — required for all functionality. (yes, all of it, she's the moment 😌)
  • Digest::MD5 — required for MD5, MD5-BASE64, CRAM-MD5, APOP.
  • Digest::SHA1 — required for CRAM-SHA1.
  • Authen::NTLM — required for NTLM/MSN/SPA.

🎀 EXIT CODES 🎀

  • 0 — no errors occurred ✅
  • 1 — unrecognized type specified 💀

🫶 CONTACT 🫶

proj-gen-auth@jetmore.net

and that's the whole page bestie, you ate it 💅 this was perl v5.36.0, dated 2026-10-24 — the GEN-AUTH(1) girlies stay winning ✨🌸💖

📦 where this page comes from