Comments (12)
Based on the code I figured out what happens.
The normal implementation works as following:
- Create a salt (byte array with random bytes)
- Take the password (convert to byte array with UTF8 encoding)
- Do the hashing with password and salt
The implementation ./np uses:
- Create a salt (byte array with random chars)
- Convert the salt to Base64
- cast this base64 string as a byte array.
- Take the password
- Do the hashing with the password and the converted -> casted salt
If you to this on both sides of the comparison (when creating the hash and when validating) their won't be a problem. So in an installation where you created the hashes with ./np and validate them with this plugin, everything is ok. I recreated these steps in C# and i can now create the accepted hashes in C#.
from mosquitto-auth-plug.
Did you solve #42 ?
Show me your configuration, and a SELECT
from your MySQL table which describes this user, please.
from mosquitto-auth-plug.
Hi JP ,
The #42 is solved.
Please find bellow all info requested:
A. Query used in mosquitto.conf:
auth_opt_userquery SELECT pw FROM users WHERE username = '%s'
B. Mysql table name users data:
id = 1
username = 123456789
pw = PBKDF2$sha256$901$SALT$dc59c53d92f078d49b34
super = 0
C. php procedure used to generate the password :
D. mosquitto daemon log
1416854800: New connection from 93.50.87.166 on port 1883.
1416854800: |-- mosquitto_auth_unpwd_check(123456789)
1416854800: |-- ** checking backend mysql
1416854800: |-- getuser(123456789) AUTHENTICATED=0 by none
Thank you in advance.
from mosquitto-auth-plug.
I'm assuming your PHP hash_pbkdf2
function is maybe not correct. Please try using the ./np
utility which is part of mosquitto_auth_plug, and replace the pw
in your database table by its output. For example, testpassword
becomes PBKDF2$sha256$901$SPCW2NbWwYdk44fC$4acm8WxwC8l2ZuL3yBNUB7KpO12LxmKT
.
FWIW, the characters "SALT
" in your hashed string look very strange to me.
from mosquitto-auth-plug.
Thank you for your help and your prompt reply.
I confirm that the above string worked. Now I'm wondering how can I generate valid hash strings from php or java. I don't like the idea to be forced to use np utility in order to work with PBKDF2 standard.
Any idea ?
PS: I have used the string "SALT" for salt only for test.
from mosquitto-auth-plug.
I honestly don't know, but you'll have to look around a bit for something that works. It's probably just your salt which is wrong, but I can't help you there.
from mosquitto-auth-plug.
@jpmens it seams that this plugin (and the ./np program) use a different way to generate the hashes. I've tried 3 different solutions for generating the Sha256 hashes (because it is by default not supported in C#) all three created by differant people. They generate the same hash given the same input variables.
I tried generating an hash with the ./np program and then generate a hash with all the parameters copied. All three solutions give me the same hash. but these are different from the one generated with the ./np program. I also tried the default C# PBKDF2 function, but that only supports Sha1 (Which also doesn't work when put into the database)
Then I found this issue, that makes me wonder if it is not the php/c# implementation that is wrong but maybe their might be some issue with the way this plugin generates the hashes.
Can you point me in the right direction? As I made the following assumptions:
- The password is converted to a byte array with the UTF8 encoding? I've tried
ASCII, UTF7, UTF8, Unicode
all without success. - The salt length is 12?
- The salt are just 12 random generated chars?
- When writing the hash string both the salt and the hash are base64 encoded?
from mosquitto-auth-plug.
I cannot comment on the PHP or any of the other contributed functions.
We've been using np.c
(with OpenSSL's PKCS5_PBKDF2_HMAC()
) and the authentication plugin in production without any issues at all. Also, please don't make assumptions: the code is there to look at. In particular, pbkdf2-check.c
shows how the checking is done.
- We've tried ASCII only
- Correct
- RAND_bytes(saltbytes, SALTLEN);
- see from here
from mosquitto-auth-plug.
Glad you got it to work. :)
from mosquitto-auth-plug.
Thank you all for contribution on this issue.
from mosquitto-auth-plug.
Hi, sorry for bumping an old issue but I was wondering why the plugin uses a non standard way of handling PBKDF2 passwords, I have a database that is handled with another application that already has users with PBKDF2 passwords but I'm unable to use them with this plugin.
from mosquitto-auth-plug.
For anyone who needs to implement this in PHP - here is a small snippet:
#!/usr/local/bin/php
<?php
function mqtt_hash($password, $salt = '', $algo = 'sha256', $iterations = 901, $key_len = 24, $salt_len = 12)
{
if($salt=='') $salt = base64_encode(openssl_random_pseudo_bytes($salt_len));
$key = base64_encode(openssl_pbkdf2($password, $salt, $key_len, $iterations, $algo));
return sprintf("PBKDF2$%s$%d$%s$%s\n",
$algo,
$iterations,
$salt,
$key);
}
$password = trim($argv[1]);
if(function_exists('readline'))
{
while($password=='')
{
$password = trim(readline('Enter password: '));
}
}
else
{
$handle = fopen ("php://stdin","r");
while($password=='')
{
echo 'Enter password: ';
$password = trim(fgets($handle));
echo chr(10);
}
fclose($handle);
}
echo 'PBKDF2 password generator for Mosquitto auth plugin [https://github.com/jpmens/mosquitto-auth-plug]',chr(10);
echo 'Encoding password = ',$password,chr(10);
echo mqtt_hash($password),chr(10);
?>
from mosquitto-auth-plug.
Related Issues (20)
- ACL issue with JWT backend HOT 2
- Inconsistencies between HTTP and JWT code & configuration HOT 3
- Merge be-http and be-jwt into one
- conf->hostname might be uninitialized in be_jwt_init() HOT 2
- ACL issue with %d placeholder - MySQL backend HOT 4
- Compilation Error HOT 1
- Compilation Error config.h: No such file or directory HOT 19
- problem with sizeof HOT 1
- Compile error with Mosquitto 1.5.5 and latest Auth-plug version HOT 2
- Websocket error: connection was lost (verbose output) HOT 4
- given the current vesion of Auth-plug, what version of mosquitto and libwebsockets should I install? HOT 1
- Fact that a user is superuser is not cached HOT 1
- mysql problem acl SUB/PUB HOT 1
- Cannot Load Auth plug-Error HOT 8
- mosquitto_client_id: symbol not found HOT 5
- Failed to create file named auth-plug.so
- Segmentation fault with BE_PSK and postgres backend HOT 1
- HTTP backend doesn't connect, instead rejects subscriptions HOT 1
- HTTP backend not calling api HOT 1
- Issue subscribing with wildcard in MongoDB and maybe MySQL HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from mosquitto-auth-plug.