kevinveenbirkenbachandClaude Opus 5.5 d48f8e9897 fix(bcrypt_hash): derive the seeded salt from the seed alone ...

The seeded salt was the first 16 bytes of sha256(seed + secret). bcrypt
stores its salt in clear inside the hash, so every seeded hash published
a fast sha256 digest of the password under a seed that is public in the
repository (`web-app-wazuh:indexer-admin`). Anyone holding the hash could
test password guesses at sha256 speed instead of paying bcrypt's cost.

The salt is now sha256(seed)[:16]. The hash stays deterministic for one
password, still changes when the password rotates, and its salt carries
nothing computed from the secret. Existing Wazuh deployments get a new
hash once; `securityadmin.sh` re-applies `internal_users.yml` on every
deploy and the hash still verifies the unchanged password.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-20 21:35:32 +02:00

..

action

Merge remote-tracking branch 'upstream/main' into feature/svc-net-wireguard

2026-10-17 09:34:00 +02:00

filter

fix(bcrypt_hash): derive the seeded salt from the seed alone

2026-10-20 21:35:32 +02:00

lookup

fix(svc-bkp-volume-2-local): read the baudolo version from pyproject.toml

2026-10-18 21:44:40 +02:00

__init__.py

…