From 61b89747ed54e17ab5c7730adbad1c5d4d5ff78a Mon Sep 17 00:00:00 2001 From: zeripath Date: Sun, 19 Feb 2023 07:35:20 +0000 Subject: [PATCH] Provide the ability to set password hash algorithm parameters (#22942) This PR refactors and improves the password hashing code within gitea and makes it possible for server administrators to set the password hashing parameters In addition it takes the opportunity to adjust the settings for `pbkdf2` in order to make the hashing a little stronger. The majority of this work was inspired by PR #14751 and I would like to thank @boppy for their work on this. Thanks to @gusted for the suggestion to adjust the `pbkdf2` hashing parameters. Close #14751 --------- Signed-off-by: Andrew Thornton Co-authored-by: delvh Co-authored-by: John Olheiser Co-authored-by: Lunny Xiao --- cmd/admin_user_change_password.go | 2 +- cmd/admin_user_create.go | 2 +- .../doc/advanced/config-cheat-sheet.en-us.md | 17 +- models/fixtures/user.yml | 130 ++++++------ models/user/user.go | 75 +------ models/user/user_test.go | 3 +- modules/auth/password/hash/argon2.go | 80 ++++++++ modules/auth/password/hash/bcrypt.go | 54 +++++ modules/auth/password/hash/common.go | 28 +++ modules/auth/password/hash/hash.go | 180 +++++++++++++++++ modules/auth/password/hash/hash_test.go | 186 ++++++++++++++++++ modules/auth/password/hash/pbkdf2.go | 67 +++++++ modules/auth/password/hash/scrypt.go | 67 +++++++ modules/auth/password/hash/setting.go | 61 ++++++ modules/auth/password/hash/setting_test.go | 38 ++++ modules/{ => auth}/password/password.go | 8 +- modules/{ => auth}/password/password_test.go | 0 modules/{ => auth}/password/pwn.go | 2 +- modules/{ => auth}/password/pwn/pwn.go | 0 modules/{ => auth}/password/pwn/pwn_test.go | 0 modules/setting/setting.go | 10 +- routers/api/v1/admin/user.go | 2 +- routers/install/install.go | 3 +- routers/web/admin/users.go | 2 +- routers/web/auth/auth.go | 2 +- routers/web/auth/password.go | 2 +- routers/web/user/setting/account.go | 2 +- 27 files changed, 871 insertions(+), 152 deletions(-) create mode 100644 modules/auth/password/hash/argon2.go create mode 100644 modules/auth/password/hash/bcrypt.go create mode 100644 modules/auth/password/hash/common.go create mode 100644 modules/auth/password/hash/hash.go create mode 100644 modules/auth/password/hash/hash_test.go create mode 100644 modules/auth/password/hash/pbkdf2.go create mode 100644 modules/auth/password/hash/scrypt.go create mode 100644 modules/auth/password/hash/setting.go create mode 100644 modules/auth/password/hash/setting_test.go rename modules/{ => auth}/password/password.go (93%) rename modules/{ => auth}/password/password_test.go (100%) rename modules/{ => auth}/password/pwn.go (93%) rename modules/{ => auth}/password/pwn/pwn.go (100%) rename modules/{ => auth}/password/pwn/pwn_test.go (100%) diff --git a/cmd/admin_user_change_password.go b/cmd/admin_user_change_password.go index 1b7c73370..7866bde91 100644 --- a/cmd/admin_user_change_password.go +++ b/cmd/admin_user_change_password.go @@ -9,7 +9,7 @@ import ( "fmt" user_model "code.gitea.io/gitea/models/user" - pwd "code.gitea.io/gitea/modules/password" + pwd "code.gitea.io/gitea/modules/auth/password" "code.gitea.io/gitea/modules/setting" "github.com/urfave/cli" diff --git a/cmd/admin_user_create.go b/cmd/admin_user_create.go index 579c6f2f6..09eaad54b 100644 --- a/cmd/admin_user_create.go +++ b/cmd/admin_user_create.go @@ -10,7 +10,7 @@ import ( auth_model "code.gitea.io/gitea/models/auth" user_model "code.gitea.io/gitea/models/user" - pwd "code.gitea.io/gitea/modules/password" + pwd "code.gitea.io/gitea/modules/auth/password" "code.gitea.io/gitea/modules/setting" "code.gitea.io/gitea/modules/util" diff --git a/docs/content/doc/advanced/config-cheat-sheet.en-us.md b/docs/content/doc/advanced/config-cheat-sheet.en-us.md index 04344b15d..36e9919bc 100644 --- a/docs/content/doc/advanced/config-cheat-sheet.en-us.md +++ b/docs/content/doc/advanced/config-cheat-sheet.en-us.md @@ -568,7 +568,22 @@ Certain queues have defaults that override the defaults set in `[queue]` (this o - `IMPORT_LOCAL_PATHS`: **false**: Set to `false` to prevent all users (including admin) from importing local path on server. - `INTERNAL_TOKEN`: **\**: Secret used to validate communication within Gitea binary. - `INTERNAL_TOKEN_URI`: ****: Instead of defining INTERNAL_TOKEN in the configuration, this configuration option can be used to give Gitea a path to a file that contains the internal token (example value: `file:/etc/gitea/internal_token`) -- `PASSWORD_HASH_ALGO`: **pbkdf2**: The hash algorithm to use \[argon2, pbkdf2, scrypt, bcrypt\], argon2 will spend more memory than others. +- `PASSWORD_HASH_ALGO`: **pbkdf2**: The hash algorithm to use \[argon2, pbkdf2, pbkdf2_v1, pbkdf2_hi, scrypt, bcrypt\], argon2 and scrypt will spend significant amounts of memory. + - Note: The default parameters for `pbkdf2` hashing have changed - the previous settings are available as `pbkdf2_v1` but are not recommended. + - The hash functions may be tuned by using `$` after the algorithm: + - `argon2$