mirror of
https://github.com/honeymoose/OpenSearch.git
synced 2025-02-05 20:48:22 +00:00
65d4f27873
* [DOCS] Add configurable password hashing docs Adds documentation about the newly introduced configuration option for setting the password hashing algorithm to be used for the users cache and for storing credentials for the native and file realm.
85 lines
5.4 KiB
Plaintext
85 lines
5.4 KiB
Plaintext
[float]
|
|
[[hashing-settings]]
|
|
==== User cache and password hash algorithms
|
|
|
|
Certain realms store user credentials in memory. To limit exposure
|
|
to credential theft and mitigate credential compromise, the cache only stores
|
|
a hashed version of the user credentials in memory. By default, the user cache
|
|
is hashed with a salted `sha-256` hash algorithm. You can use a different
|
|
hashing algorithm by setting the `cache.hash_algo` realm settings to any of the
|
|
following values:
|
|
|
|
[[cache-hash-algo]]
|
|
.Cache hash algorithms
|
|
|=======================
|
|
| Algorithm | | | Description
|
|
| `ssha256` | | | Uses a salted `sha-256` algorithm (default).
|
|
| `md5` | | | Uses `MD5` algorithm.
|
|
| `sha1` | | | Uses `SHA1` algorithm.
|
|
| `bcrypt` | | | Uses `bcrypt` algorithm with salt generated in 1024 rounds.
|
|
| `bcrypt4` | | | Uses `bcrypt` algorithm with salt generated in 16 rounds.
|
|
| `bcrypt5` | | | Uses `bcrypt` algorithm with salt generated in 32 rounds.
|
|
| `bcrypt6` | | | Uses `bcrypt` algorithm with salt generated in 64 rounds.
|
|
| `bcrypt7` | | | Uses `bcrypt` algorithm with salt generated in 128 rounds.
|
|
| `bcrypt8` | | | Uses `bcrypt` algorithm with salt generated in 256 rounds.
|
|
| `bcrypt9` | | | Uses `bcrypt` algorithm with salt generated in 512 rounds.
|
|
| `pbkdf2` | | | Uses `PBKDF2` key derivation function with `HMAC-SHA512` as a
|
|
pseudorandom function using 10000 iterations.
|
|
| `pbkdf2_1000` | | | Uses `PBKDF2` key derivation function with `HMAC-SHA512` as a
|
|
pseudorandom function using 1000 iterations.
|
|
| `pbkdf2_10000` | | | Uses `PBKDF2` key derivation function with `HMAC-SHA512` as a
|
|
pseudorandom function using 10000 iterations.
|
|
| `pbkdf2_50000` | | | Uses `PBKDF2` key derivation function with `HMAC-SHA512` as a
|
|
pseudorandom function using 50000 iterations.
|
|
| `pbkdf2_100000` | | | Uses `PBKDF2` key derivation function with `HMAC-SHA512` as a
|
|
pseudorandom function using 100000 iterations.
|
|
| `pbkdf2_500000` | | | Uses `PBKDF2` key derivation function with `HMAC-SHA512` as a
|
|
pseudorandom function using 500000 iterations.
|
|
| `pbkdf2_1000000` | | | Uses `PBKDF2` key derivation function with `HMAC-SHA512` as a
|
|
pseudorandom function using 1000000 iterations.
|
|
| `noop`,`clear_text` | | | Doesn't hash the credentials and keeps it in clear text in
|
|
memory. CAUTION: keeping clear text is considered insecure
|
|
and can be compromised at the OS level (for example through
|
|
memory dumps and using `ptrace`).
|
|
|=======================
|
|
|
|
Likewise, realms that store passwords hash them using cryptographically strong
|
|
and password-specific salt values. You can configure the algorithm for password
|
|
hashing by setting the `xpack.security.authc.password_hashing.algorithm` setting
|
|
to one of the following:
|
|
|
|
[[password-hashing-algorithms]]
|
|
.Password hashing algorithms
|
|
|=======================
|
|
| Algorithm | | | Description
|
|
|
|
| `bcrypt` | | | Uses `bcrypt` algorithm with salt generated in 1024 rounds. (default)
|
|
| `bcrypt4` | | | Uses `bcrypt` algorithm with salt generated in 16 rounds.
|
|
| `bcrypt5` | | | Uses `bcrypt` algorithm with salt generated in 32 rounds.
|
|
| `bcrypt6` | | | Uses `bcrypt` algorithm with salt generated in 64 rounds.
|
|
| `bcrypt7` | | | Uses `bcrypt` algorithm with salt generated in 128 rounds.
|
|
| `bcrypt8` | | | Uses `bcrypt` algorithm with salt generated in 256 rounds.
|
|
| `bcrypt9` | | | Uses `bcrypt` algorithm with salt generated in 512 rounds.
|
|
| `bcrypt10` | | | Uses `bcrypt` algorithm with salt generated in 1024 rounds.
|
|
| `bcrypt11` | | | Uses `bcrypt` algorithm with salt generated in 2048 rounds.
|
|
| `bcrypt12` | | | Uses `bcrypt` algorithm with salt generated in 4096 rounds.
|
|
| `bcrypt13` | | | Uses `bcrypt` algorithm with salt generated in 8192 rounds.
|
|
| `bcrypt14` | | | Uses `bcrypt` algorithm with salt generated in 16384 rounds.
|
|
| `pbkdf2` | | | Uses `PBKDF2` key derivation function with `HMAC-SHA512` as a
|
|
pseudorandom function using 10000 iterations.
|
|
| `pbkdf2_1000` | | | Uses `PBKDF2` key derivation function with `HMAC-SHA512` as a
|
|
pseudorandom function using 1000 iterations.
|
|
| `pbkdf2_10000` | | | Uses `PBKDF2` key derivation function with `HMAC-SHA512` as a
|
|
pseudorandom function using 10000 iterations.
|
|
| `pbkdf2_50000` | | | Uses `PBKDF2` key derivation function with `HMAC-SHA512` as a
|
|
pseudorandom function using 50000 iterations.
|
|
| `pbkdf2_100000` | | | Uses `PBKDF2` key derivation function with `HMAC-SHA512` as a
|
|
pseudorandom function using 100000 iterations.
|
|
| `pbkdf2_500000` | | | Uses `PBKDF2` key derivation function with `HMAC-SHA512` as a
|
|
pseudorandom function using 500000 iterations.
|
|
| `pbkdf2_1000000` | | | Uses `PBKDF2` key derivation function with `HMAC-SHA512` as a
|
|
pseudorandom function using 1000000 iterations.
|
|
|=======================
|
|
|
|
|