User passwords should be stored in the database as a SSHA hash. This will prevent them from being discovered from the database or through leakage in the GUI. Code to create the hashes is as follows:

require 'sha1'
require 'base64'
password = [get some password from the user]
salt = rand(255).chr + rand(255).chr + rand(255).chr + rand(255).chr
hash = "{SSHA}"+Base64.encode64(Digest::SHA1.digest(password + salt )+ salt ).chomp!

Then to check the password, do this:

1. Verify the first 6 characters are "{SSHA}" and then strip them off
   
2. base64 decode what is left
   
3. now throw away the first 20 characters. What is left is the salt.
   
4. Take the salt and the password given to us by the user and run them through the algorithm above. The result should match exactly (case sensitive) the original stored password hash.

By using the above algorithm we remain compatible with external systems such as LDAP. http://www.openldap.org/faq/data/cache/347.html