saltyming/vaultwarden
1
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.git synced 2025-08-13 06:29:06 +00:00
Code Activity

Admin token Argon2 hashing support

Browse source 
Added support for Argon2 hashing support for the `ADMIN_TOKEN` instead
of only supporting a plain text string.

The hash must be a PHC string which can be generated via the `argon2`
CLI **or** via the also built-in hash command in Vaultwarden.

You can simply run `vaultwarden hash` to generate a hash based upon a
password the user provides them self.

Added a warning during startup and within the admin settings panel is
the `ADMIN_TOKEN` is not an Argon2 hash.

Within the admin environment a user can ignore that warning and it will
not be shown for at least 30 days. After that the warning will appear
again unless the `ADMIN_TOKEN` has be converted to an Argon2 hash.

I have also tested this on my RaspberryPi 2b and there the `Bitwarden`
preset takes almost 4.5 seconds to generate/verify the Argon2 hash.

Using the `OWASP` preset it is below 1 second, which I think should be
fine for low-graded hardware. If it is needed people could use lower
memory settings, but in those cases I even doubt Vaultwarden it self
would run. They can always use the `argon2` CLI and generate a faster hash.
This commit is contained in:
BlackDex 2023-02-28 23:09:51 +01:00
commit de157b2654
No known key found for this signature in database
GPG key ID: 58C80A2AA6C765E1
8 changed files with 240 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

60
Cargo.lock generated
View file

@ -85,6 +85,17 @@ dependencies = [
"libc",
]
[[package]]
name = "argon2"
version = "0.5.0-pre.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0efde6c15a373abaefe544ddae9fc024eac3073798ba0c40043fd655f3535eb8"
dependencies = [
"base64ct",
"blake2",
"password-hash",
]
[[package]]
name = "async-channel"
version = "1.8.0"
@ -324,6 +335,12 @@ version = "0.21.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a4a4ddaa51a5bc52a6948f74c06d20aaaddb71924eab79b8c97a8c556e942d6a"
[[package]]
name = "base64ct"
version = "1.6.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8c3c1a368f70d6cf7302d78f8f7093da241fb8e8807c05cc9e51a125895a6d5b"
[[package]]
name = "binascii"
version = "0.1.4"
@ -336,6 +353,15 @@ version = "1.3.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
[[package]]
name = "blake2"
version = "0.10.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
dependencies = [
"digest",
]
[[package]]
name = "block-buffer"
version = "0.10.3"
@ -2006,6 +2032,17 @@ dependencies = [
"regex",
]
[[package]]
name = "password-hash"
version = "0.5.0-pre.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4d9d7f72dbf886af2c2a8d4a2ddfb4eea37e4d77ea3bde49f79af7c577e37908"
dependencies = [
"base64ct",
"rand_core",
"subtle",
]
[[package]]
name = "paste"
version = "1.0.11"
@ -2585,6 +2622,27 @@ dependencies = [
"uncased",
]
[[package]]
name = "rpassword"
version = "7.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6678cf63ab3491898c0d021b493c94c9b221d91295294a2a5746eacbe5928322"
dependencies = [
"libc",
"rtoolbox",
"winapi",
]
[[package]]
name = "rtoolbox"
version = "0.0.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "034e22c514f5c0cb8a10ff341b9b048b5ceb21591f31c8f44c43b960f9b3524a"
dependencies = [
"libc",
"winapi",
]
[[package]]
name = "rustc-demangle"
version = "0.1.21"
@ -3425,6 +3483,7 @@ dependencies = [
name = "vaultwarden"
version = "1.0.0"
dependencies = [
"argon2",
"backtrace",
"bytes",
"cached",
@ -3464,6 +3523,7 @@ dependencies = [
"ring",
"rmpv",
"rocket",
"rpassword",
"semver",
"serde",
"serde_json",