search

dotCMS / core

Headless/Hybrid Content Management System for Enterprises
http://dotcms.com
Other
849 stars 467 forks source link

Increase Password Hash Iterations #23915

Closed wezell closed 1 year ago

wezell commented 1 year ago

Problem Statement

Passwords stored in dotCMS are hashed multiple times using an industry recognized algo PBKDF2-HMAC-SHA256. When we implemented password hashing, 20,000 iterations were enough to slow down a brute force cracking attack. With todays modern processors and GPUs, OWasp recommends at least 600,000 iterations of hashing to protect passwords from modern hardware. See this page for more information:

https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2

Luckily, dotCMS's password impl allows us to up the number of hashings without much drama, and it takes effect the next time a user logs in - dotCMS will automatically re-hash the users password with the correct number of iterations. Note that it is impossible to go back and re-hash user's passwords without the user's interaction - as we need the password in the clear to be able to re-hash it.

Steps to Reproduce

Login

Acceptance Criteria

  1. Set up a new starter.
  2. Take a look at the user's password in the database and see that it is not hashed.
    select password_ from user_ where userid='dotcms.org.1';
  3. Login as that user.
  4. Take a look at the user's password in the database. You will see that it has been updated and is now hashed.
  5. You should also see a log message like : 
    12:32:08.187  INFO  util.SecurityLogger - class com.dotmarketing.cms.login.factories.LoginFactory : User (dotcms.org.1) password was re-hashed 600000 times -- ip:127.0.0.1,user:null

dotCMS Version

4.x-23.01

Proposed Objective

Security & Privacy

Proposed Priority

Priority 2 - Important

External Links... Slack Conversations, Support Tickets, Figma Designs, etc.

No response

Assumptions & Initiation Needs

No response

Sub-Tasks & Estimates

No response

mbiuki commented 1 year ago

Please have me review it before this code is merged. Must ensure the enumeration issue is also fixed, thanks.

jcastro-dotcms commented 1 year ago

NOTE TO QA

Here are the steps to verify the code fix:

  1. Start up dotCMS 23.01, and log in.
  2. Shut it down, and change the image to the latest 23.03 in DockerHub.
  3. Start it up and log in again. Right after that, you must see the following entry in the dotcms.log file: 
    User (dotcms.org.1) password was re-hashed 600000 times
fmontes commented 1 year ago
image
bryanboza commented 1 year ago

Fixed, tested on release-23.03 // Docker // FF