Include tool to add users to htpasswd file offline.

[mx-moth]

Currently, to add a user to a private sinopia registry, user registrations must be opened to the world. The user should then sign up, and registrations be locked down again.

This is insecure, as an attacker could sign up in the brief time that the real user is creating their account. Additionally, this method requires restarting the sinopia server twice, which is not great if it is in continuous use.

An alternative is to offer a command line tool that adds a user to a htpasswd file that administrators can run on the server itself. Because this does not open registrations to anyone who does not already have SSH access to the box, this is secure.

I have written a tool (https://bitbucket.org/takeflight/sinopia-aduser) which does exactly this. If you're interested, I can create a pull request that adds this functionality to this package, or you could use the code for inspiration if you implement this yourself.

[rlidwka]

Adding users manually is insecure, because system administrator will know the password user will be logging in with. And I think it is much worse than having registrations opened.

In fact, I don't see how an attacker will benefit from registering at all. This is standard procedure we use to add new developers:

1. We ask them to register on the server using npm adduser --reg http://.../
2. After they do this, we ask for their username and exact time when they registered to verify. Check that and add them to an appropriate usergroup.

This way even if someone registers on the servers, she will not have an access to any repos.

That said, if you want to create a PR for such CLI tool, I'll accept it.

PS: you can already add new users manually with this command (I'll add that to readme):

$ echo "user:`mkpasswd --method=sha-512 password`" >> htpasswd

[mx-moth]

The user is prompted to enter their password if their password is not provided on the command line, so the password input can still be secure. I'll make this in to a pull request in the next few days and send it your way. The example line you gave above would also be very useful in the docs, as well as a note saying that the standard htpasswd executable from Apache is not compatible with the htpasswd file for sinopia. That caused some confusion!

[rlidwka]

the standard htpasswd executable from Apache is not compatible with the htpasswd file for sinopia

Maybe we can make it compatible with for example apache-md5 module. I'll check that out.