Allow hashed passwords

homeassistant/components/http.py

@@ -200,12 +200,17 @@ def _handle_request(self, method):  # pylint: disable=too-many-branches
                     "Error parsing JSON", HTTP_UNPROCESSABLE_ENTITY)
                 return
 
-        self.authenticated = (self.server.api_password is None or
-                              self.headers.get(HTTP_HEADER_HA_AUTH) ==
-                              self.server.api_password or
-                              data.get(DATA_API_PASSWORD) ==
-                              self.server.api_password or
-                              self.verify_session())
+        self.authenticated = (
+            self.server.api_password is None or
+            util.check_password(self.server.api_password,
+                                self.headers.get(HTTP_HEADER_HA_AUTH)) or
+            util.check_password(self.server.api_password,
+                                self.headers.get(DATA_API_PASSWORD)) or
+            self.headers.get(HTTP_HEADER_HA_AUTH) ==
+            self.server.api_password or
+            data.get(DATA_API_PASSWORD) ==
+            self.server.api_password or
+            self.verify_session())
 
         if '_METHOD' in data:
             method = data.pop('_METHOD')

homeassistant/util/__init__.py

@@ -9,6 +9,7 @@
 import socket
 import random
 import string
+import hashlib
 from functools import wraps
 from types import MappingProxyType
 
@@ -99,6 +100,16 @@ def get_random_string(length=10):
     return ''.join(generator.choice(source_chars) for _ in range(length))
 
 
+def check_password(hashed_password, plain_password):
+    """Check the hashed password against a plain-text one."""
+    try:
+        password, salt = hashed_password.split(':')
+        return password == hashlib.sha512(
+            salt.encode() + plain_password.encode()).hexdigest()
+    except (AttributeError, ValueError):
+        return None
+
+
 class OrderedEnum(enum.Enum):
     """Taken from Python 3.4.0 docs."""
 

script/gen_hash.py

@@ -0,0 +1,30 @@
+#!/usr/bin/python3
+"""Generate a SHA512 hash from a given string."""
+import getpass
+import hashlib
+import uuid
+
+
+def hash_password(password):
+    """Create a hash of the given password"""
+    salt = uuid.uuid4().hex
+    return hashlib.sha512(
+        salt.encode() + password.encode()).hexdigest() + ':' + salt
+
+
+def check_password(hashed_password, plain_password):
+    """Check the given password against the re-entered one."""
+    password, salt = hashed_password.split(':')
+    return password == hashlib.sha512(
+        salt.encode() + plain_password.encode()).hexdigest()
+
+response1 = getpass.getpass('Please enter your password: ')
+response2 = getpass.getpass('Please enter your password again: ')
+
+hashed = hash_password(response1)
+
+if check_password(hashed, response2):
+    print('\nPut the hash in your configuration.yaml file.')
+    print(hashed)
+else:
+    print('No match! Please try again.')