Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

config switch to upgrade operator and server passwords to new algorithm #1990

Open
slingamn opened this issue Aug 22, 2022 · 0 comments
Open

Comments

@slingamn
Copy link
Member

User account passwords are hashed with the new-style algorithm described on #212 (first pass of SHA3-512, followed by bcrypt). However, the hash of the server password (for the optional PASS command) and the operator passwords (for the OPERATOR command) are written into the config file and cannot be autoupgraded, hence they still use the old-style algorithm (a single pass of bcrypt). Consequently they are subject to the implicit 72-character length limit.

We could add a config switch that says that the hashes should be compared via the v2 algorithm, instead of the v1 algorithm. (When omitted, it would default to v1). Then, ergo genpasswd could be made to require a valid configuration file (compare ergo mkcerts, which reads the config file to determine where to put the generated certificates) and it could generate certificates according to the algorithm specified in the file. Then default.yaml and traditional.yaml could be modified to have the v2 algorithm as the recommended default.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant