Details
-
Improvement
-
Resolution: Fixed
-
Minor
-
Future Dev
-
MOODLE_403_STABLE
-
master_
MDL-67390 -
0) Setup steps (prior to applying this patch to your Moodle site code):
- We need to create some users with legacy md5 password hashes. You will need direct access to your Moodle LMS database
- Create a couple of users via SQL with known md5 hashed passwords
- For example: run the following sql statements against your Moodle database:
INSERT INTO m_user (username, password) VALUES ('foo__unique', '5f4dcc3b5aa765d61d8327deb882cf99'); --PW: password
INSERT INTO m_user (username, password) VALUES ('bar__unique', 'b497dd1a701a33026f7211533620780d'); --PW: drowssap
- Also make sure you have some users in your Moodle instance has some users who are able to log in using a user name and password via the Moodle login page
- Apply the patch from this issue to the Moodle instance
- Run the upgrade process
- Confirm your Moodle LMS upgrades without error.
1) Md5 DB check:
- Check the Moodle DB for the password entries for the users that were created with md5 hashes.
- Confirm the password hashes are no longer in the md5 (32 char) format and that they start with '$6$rounds=10000'
2)Existing user test:
- Confirm that the users that could log in prior to the upgrade can still log in after the patch is applied. (not the users created by sql with md5 hashes)
- Confirm that the users with the md5 password hashes cannot log in.
3) Password change test.
- Change the password of an existing user has been able to log in.
- Confirm that the user is able to log in using their user name and new password via the Moodle login page
4) User upload test.
- Login as an admin
- Navigate to: Site administration > Users > Upload users
- Upload the
mdl-67774.csvusers.csv
file attached to this issue - Change the "New user password" option to "Field required in file.
- Click the "Upload users" button
- Confirm there are no errors with the upload
- Click the "continue" button
- Log out as admin
- Confirm that the user created from the csv can log in with the password from the csv
5) New user test.
- Login as an admin
- Create a new user from the UI
- Log out as admin
- Confirm that the user created can log in with their password
6) Mobile app SSO login.
- Get or create an existing user that can log in with a username and password. Must not be a site admin.
- You will need to know their internal Moodle user id.
- Using cURL (wget or whatever you like to make requests outside of a browser, run the command:
- curl 'https://webserver/login/token.php?username=testuser&password=sEcReTpAsSwOrD&service=moodle_mobile_app'
- Replace 'webserver' with the domain of your Moodle instance
- You MUST use a HTTPS site for this test
- This command will return a response in the format of: {"token":"7c1bd46b379ecfa6874a49564f4539a7","privatetoken":"IYvPCLomSLYfGTCCX57kZoVBxQWWxQyCVLzeF8dF5rPPCPVUubqgkEtiAAoFzAYM"}
- Within the next 60 seconds, replace the token and private token in the following command (replacing the domain with that of your test site) and then run it:
curl 'https://webserver/webservice/rest/server.php?moodlewsrestformat=json' \
-A "MoodleMobile" \
--data 'privatetoken=IYvPCLomSLYfGTCCX57kZoVBxQWWxQyCVLzeF8dF5rPPCPVUubqgkEtiAAoFzAYM&wsfunction=tool_mobile_get_autologin_key&wstoken=7c1bd46b379ecfa6874a49564f4539a7' - The command will return a response in the format: {"key":"1bf8caab3fe7ed06918909dad5f5ccf8","autologinurl":"https:\/\/webserver\/admin\/tool\/mobile\/autologin.php","warnings":[]}
- Within the next 60 seconds, replace the key in the following:
https://webserver/admin/tool/mobile/autologin.php?key=1bf8caab3fe7ed06918909dad5f5ccf8&userid=3- Replace the domain with your test server
- replace the userid with the id of the user who you supplied the username and password for
- Copy and past the URL into a browser
- Confirm you are now logged into Moodle
0) Setup steps (prior to applying this patch to your Moodle site code): We need to create some users with legacy md5 password hashes. You will need direct access to your Moodle LMS database Create a couple of users via SQL with known md5 hashed passwords For example: run the following sql statements against your Moodle database: INSERT INTO m_user (username, password) VALUES ( 'foo__unique' , '5f4dcc3b5aa765d61d8327deb882cf99' ); --PW: password INSERT INTO m_user (username, password) VALUES ( 'bar__unique' , 'b497dd1a701a33026f7211533620780d' ); --PW: drowssap Also make sure you have some users in your Moodle instance has some users who are able to log in using a user name and password via the Moodle login page Apply the patch from this issue to the Moodle instance Run the upgrade process Confirm your Moodle LMS upgrades without error. 1) Md5 DB check: Check the Moodle DB for the password entries for the users that were created with md5 hashes. Confirm the password hashes are no longer in the md5 (32 char) format and that they start with '$6$rounds=10000' 2)Existing user test: Confirm that the users that could log in prior to the upgrade can still log in after the patch is applied. (not the users created by sql with md5 hashes) Confirm that the users with the md5 password hashes cannot log in. 3) Password change test. Change the password of an existing user has been able to log in. Confirm that the user is able to log in using their user name and new password via the Moodle login page 4) User upload test. Login as an admin Navigate to: Site administration > Users > Upload users Upload the mdl-67774.csv users.csv file attached to this issue Change the "New user password" option to "Field required in file. Click the "Upload users" button Confirm there are no errors with the upload Click the "continue" button Log out as admin Confirm that the user created from the csv can log in with the password from the csv 5) New user test. Login as an admin Create a new user from the UI Log out as admin Confirm that the user created can log in with their password 6) Mobile app SSO login. Get or create an existing user that can log in with a username and password. Must not be a site admin. You will need to know their internal Moodle user id. Using cURL (wget or whatever you like to make requests outside of a browser, run the command: curl ' https://webserver/login/token.php?username=testuser&password=sEcReTpAsSwOrD&service=moodle_mobile_app' Replace 'webserver' with the domain of your Moodle instance You MUST use a HTTPS site for this test This command will return a response in the format of: {"token":"7c1bd46b379ecfa6874a49564f4539a7","privatetoken":"IYvPCLomSLYfGTCCX57kZoVBxQWWxQyCVLzeF8dF5rPPCPVUubqgkEtiAAoFzAYM"} Within the next 60 seconds , replace the token and private token in the following command (replacing the domain with that of your test site) and then run it: curl 'https://webserver/webservice/rest/server.php?moodlewsrestformat=json' \ -A "MoodleMobile" \ --data 'privatetoken=IYvPCLomSLYfGTCCX57kZoVBxQWWxQyCVLzeF8dF5rPPCPVUubqgkEtiAAoFzAYM&wsfunction=tool_mobile_get_autologin_key&wstoken=7c1bd46b379ecfa6874a49564f4539a7' The command will return a response in the format: {"key":"1bf8caab3fe7ed06918909dad5f5ccf8","autologinurl":"https:\/\/webserver\/admin\/tool\/mobile\/autologin.php","warnings":[]} Within the next 60 seconds , replace the key in the following: https://webserver/admin/tool/mobile/autologin.php?key=1bf8caab3fe7ed06918909dad5f5ccf8&userid=3 Replace the domain with your test server replace the userid with the id of the user who you supplied the username and password for Copy and past the URL into a browser Confirm you are now logged into Moodle
-
2
-
Team Hedgehog 2023 Review 2, Team Hedgehog 2023 Sprint 3.1
Description
This is broadly very similar to MDL-36057 where we updated from md5 to password_hash() which uses bcrypt (blowfish), here we want to upgrade from blowfish to something which is more modern and approved by various gov agencies, eg SHA-256, SHA-384, SHA-512:
"The only approved hashing algorithm is Secure Hashing Algorithm 2 (SHA-2)." - https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography
"NIST recommends that federal agencies transition away from SHA-1 for all applications as soon as possible. Federal agencies should use SHA-2 or SHA-3 as an alternative to SHA-1." - https://csrc.nist.gov/Projects/Hash-Functions/NIST-Policy-on-Hash-Functions
Also as part of this we should update the password history tracking in a way that either uses the same more secure hash, or treats this more as a checksum rather than a hash as we only need to look for collisions and a false positive here doesn't matter (unlike a real password check). https://github.com/moodle/moodle/blob/master/user/lib.php#L1011-L1024
In terms of hashing performance, test runs were conducted using SHA256 and SHA512 and compared against the current bcrypt method. For the SHA2 class of algorithms a new random salt was generated for each hash (as it would be for a password hashing process). The results show that SHA2 is much faster than bcrypt with negligible calculation time between SHA256 and SHA512
Generating 1000 hashes using bcrypt...
|
Cost: 4, Time: 1.1055860519409 seconds
|
Cost: 10, Time: 72.641986131668 seconds
|
Generating 1000 hashes using SHA256...
|
Rounds: 5000, Time: 4.1576209068298 seconds
|
Rounds: 10000, Time: 8.0215101242065 seconds
|
Generating 1000 hashes using SHA512...
|
Rounds: 5000, Time: 4.2004630565643 seconds
|
Rounds: 10000, Time: 8.4337508678436 seconds
|
Approach for new hashing:
- Enforce SHA512 as the new algorithm and upgrading bcrypt on login (lazy upgrade)
- Deprecate MD5 support completely and remove it. We’re now past “lazy upgrading” of legacy MD5 based hashes.
- Remove the checks and code to upgrade md5 passwords on login. (users with md5 hashed passwords will no longer be able to login without resetting their password).
- On upgrade set all md5 hashed passwords to a new random password using the new hash method (to get rid of insecure hashes in the db)
