Authenticating to Server Services "requires storing your password in a less secure form" I've bought and downloaded the MacOS Server application to host a VPN and to host a Satis repository.

When enabling either the VPN or Websites services, a dialogue appears asking "Do you want to change how your password is stored?", with the advice that "Authenticating to this service requires storing your password in a less secure form."

I can't find any further information on this, not from the Server documentation, nor from searching on Google.


What does this actually mean?
Why is this necessary?
Does it pertain to my MacOS user account credentials? If so, will it only affect the credentials of the account that the Server application is being run from (if this is the case, I will create a separate user account to run the Server app)?


Many thanks for your time and help.
OS X stores your passworded in a "salted hash" one-way encrypted format (See this question which "scrambles" your password (combined with a "salt") in such a way that it can't be decrypted, but produces the same value every time.

Depending on how Apache is configured, it uses different (normally salted) algorithms, including MD5, SHA1 and crypt: see the documentation

These are easier to crack than SHA-512, but also fairly secure (they do use a salt, and are one-way hashes. An attacker would need to get the htpasswd file to crack your password)

The same is true of the VPN server: I'm not sure what hashing algorithm it uses, but it's one with less entropy than the internal user database, which is what the warning means.

It's necessary because each piece of software is written by different maintainers (the web server by Apache, for example) and not by Apple, and because they store your password rather than authenticating you against the OS X user database.

It pertains to whatever users are allowed to authenticate to those services (the VPN and Web services) and not the user account that the Server app is running as.