{"action":"created","issue":{"url":"https://api.github.com/repos/pi-hole/pi-hole/issues/2521","repository_url":"https://api.github.com/repos/pi-hole/pi-hole","labels_url":"https://api.github.com/repos/pi-hole/pi-hole/issues/2521/labels{/name}","comments_url":"https://api.github.com/repos/pi-hole/pi-hole/issues/2521/comments","events_url":"https://api.github.com/repos/pi-hole/pi-hole/issues/2521/events","html_url":"https://github.com/pi-hole/pi-hole/issues/2521","id":384155728,"node_id":"MDU6SXNzdWUzODQxNTU3Mjg=","number":2521,"title":"Insecure password hashing: salt needed","user":{"login":"nbros652","id":15335572,"node_id":"MDQ6VXNlcjE1MzM1NTcy","avatar_url":"https://avatars0.githubusercontent.com/u/15335572?v=4","gravatar_id":"","url":"https://api.github.com/users/nbros652","html_url":"https://github.com/nbros652","followers_url":"https://api.github.com/users/nbros652/followers","following_url":"https://api.github.com/users/nbros652/following{/other_user}","gists_url":"https://api.github.com/users/nbros652/gists{/gist_id}","starred_url":"https://api.github.com/users/nbros652/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nbros652/subscriptions","organizations_url":"https://api.github.com/users/nbros652/orgs","repos_url":"https://api.github.com/users/nbros652/repos","events_url":"https://api.github.com/users/nbros652/events{/privacy}","received_events_url":"https://api.github.com/users/nbros652/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2018-11-26T02:58:04Z","updated_at":"2018-11-28T04:37:02Z","closed_at":null,"author_association":"NONE","body":"**In raising this issue, I confirm the following:** `{please fill the checkboxes, e.g: [X]}`\r\n\r\n- [X] I have read and understood the [contributors guide](https://github.com/pi-hole/pi-hole/blob/master/CONTRIBUTING.md).\r\n- [X] The issue I am reporting can be *replicated*.\r\n- [X] The issue I am reporting isn't a duplicate (see [FAQs](https://github.com/pi-hole/pi-hole/wiki/FAQs), [closed issues](https://github.com/pi-hole/pi-hole/issues?utf8=%E2%9C%93&q=is%3Aissue%20is%3Aclosed%20), and [open issues](https://github.com/pi-hole/pi-hole/issues)).\r\n\r\n**How familiar are you with the the source code relevant to this issue?:**\r\n\r\n`8`\r\n\r\n---\r\n**Expected behaviour:**\r\n\r\n`When creating a password for the web interface, the password should be `[hashed with a salt](https://crackstation.net/hashing-security.htm#salt)` to protect against rainbow table attacks. Changing this salt on each password change would probably be a good idea as well. This salt value should be stored in /etc/pihole/setupVars.conf along with the password hash so that passwords can be rehashed for authentication.`\r\n\r\n**Actual behaviour:**\r\n\r\n`Reviewing pi-hole/advanced/Scripts/webpage.sh reveals in the HashPassword function at lines 86-91 (latest commit of file on master branch as of reporting: b54e32f), that passwords are simply hashed twice. While a comment indicates that the intent is to \"avoid rainbow table vulnerability,\" multiple hash iterations alone is insufficient protection against rainbow table attacks! Multiple iterations is good and should remain.`\r\n\r\n**Steps to reproduce:**\r\n\r\n`Create a web console password.`\r\n\r\n**Other affected repositories/files:**\r\n\r\n`Fixing this behaviour will require changes to the repository that houses the web interfaces as well, namely `[pi-hole/AdminLTE](https://github.com/pi-hole/AdminLTE)`. In particular, it is evident that the  AdminLTE/scripts/pi-hole/php/password.php file would need to be updated around line 61 (latest commit of file on master branch as of reporting: 96039f5).`\r\n\r\n**Debug token provided by [uploading `pihole -d` log](https://discourse.pi-hole.net/t/the-pihole-command-with-examples/738#debug):**\r\n\r\n`N/A`\r\n\r\n**Troubleshooting undertaken, and/or other relevant information:**\r\n\r\n`N/A `\r\n"},"comment":{"url":"https://api.github.com/repos/pi-hole/pi-hole/issues/comments/442316992","html_url":"https://github.com/pi-hole/pi-hole/issues/2521#issuecomment-442316992","issue_url":"https://api.github.com/repos/pi-hole/pi-hole/issues/2521","id":442316992,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MjMxNjk5Mg==","user":{"login":"Mcat12","id":4417660,"node_id":"MDQ6VXNlcjQ0MTc2NjA=","avatar_url":"https://avatars2.githubusercontent.com/u/4417660?v=4","gravatar_id":"","url":"https://api.github.com/users/Mcat12","html_url":"https://github.com/Mcat12","followers_url":"https://api.github.com/users/Mcat12/followers","following_url":"https://api.github.com/users/Mcat12/following{/other_user}","gists_url":"https://api.github.com/users/Mcat12/gists{/gist_id}","starred_url":"https://api.github.com/users/Mcat12/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Mcat12/subscriptions","organizations_url":"https://api.github.com/users/Mcat12/orgs","repos_url":"https://api.github.com/users/Mcat12/repos","events_url":"https://api.github.com/users/Mcat12/events{/privacy}","received_events_url":"https://api.github.com/users/Mcat12/received_events","type":"User","site_admin":false},"created_at":"2018-11-28T04:37:02Z","updated_at":"2018-11-28T04:37:02Z","author_association":"MEMBER","body":"Yes, that's about the gist of it. There's no good way to secure HTTP authentication without rolling your own authentication protocol or implementing something like TLS (making the connection now HTTPS).\r\n\r\nThe issue has been largely ignored or deferred in other applications. Most routers log in via Basic Authentication over HTTP, which is basically just base64 encoding the password. Other locally installed applications either just live with HTTP or add a self-signed cert, which needs to be accepted on all the devices that connect to it (and is usually still marked as insecure or untrusted)."}}
{"actor":{"display_login":"Mcat12"}}