[Security] Hash users.server_admin.password in config #1308

New Issue

MrUnknownDE · 2026-04-05T18:50:45+02:00

MrUnknownDE commented

2026-04-05 18:50:45 +02:00

Originally created by @dystopiandev on 6/26/2025

users.server_admin.password is configured in plain text, but it would be better to have it as a hash. This would typically use bcrypt or some other algo if pangolin uses something different under the hood.

For backwards compatibility, maybe introduce users.server_admin.passwordHash? Also make this the default installer behavior, and document how to generate the hash (work factor, etc.) for manual installation.

Reason: Plain text passwords are readable by anyone who gains access to the config file. If the file is leaked or compromised, the attacker immediately knows the password. On the other hand, since bcrypt is a one-way hashing algo, the original password cannot be directly recovered from the hash.

*Originally created by @dystopiandev on 6/26/2025* `users.server_admin.password` is configured in plain text, but it would be better to have it as a hash. This would typically use bcrypt or some other algo if pangolin uses something different under the hood. For backwards compatibility, maybe introduce `users.server_admin.passwordHash`? Also make this the default installer behavior, and document how to generate the hash (work factor, etc.) for manual installation. Reason: Plain text passwords are readable by anyone who gains access to the config file. If the file is leaked or compromised, the attacker immediately knows the password. On the other hand, since bcrypt is a one-way hashing algo, the original password cannot be directly recovered from the hash.

MrUnknownDE closed this issue

2026-04-05 18:50:45 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1308