5

I am no expert in salt hash but while I was installing Acquia Dev, I noticed a variable $drupal_hash_salt, filled with a randomly generated string, in settings.php of newly installed Drupal 7 and a file called .hashlist under root drupal installation folder. Can someone help me understand the salting concepts in Drupal 7?

When I tried to import a new version of Drupal 7 site, I could not see any random string in that same variable and also no .hashlist file. I may be doing something wrong here. I tried googling around to see if I could find something useful but no luck.

So I have 3 questions

  1. How to do salt hashing in Drupal 7 during/before installation process?

  2. What kinds of data are being hashed (other than password)?

  3. How can I extend this salting concept further?

Thanks a lot in advance.

Improve this question

2 Answers 2

Reset to default
4

I talk a bit about the new salts in my article on Improvements to Security in Drupal 7 which may help answer these questions.

Depending on when you need the salt you might be able to use drupal_get_hash_salt or you may be able to leverage the code it uses to create your hash.

Can you expand on "extend this salting concept" ? What kind of extension do you want to do?

Salting is a standard part of hashing. You can read about salting on the php hashing pages. Changing your salt after the site is live may cause some problems in specific areas. My guess is that it depends on which modules you have installed and which features you are using. The one-time-login links are likely to stop working, but I'm not sure of other specific functionality that would stop.

Improve this answer
5
  • Hi Greggles. First of all, let me take this opportunity to thank you (Drupal Security team leader), for taking time and replying to my query. However while going through your informative article about security I am still in dark on how to exactly use this technology to my benefit. The settings.php file talks about creating a file "salt.txt" and asks to add some contents that will then be used as salt.
    – Minty
    Nov 24, 2011 at 13:42
  • And put that file outside drupal directory with chmod 666? And I have to do this before I install drupal 7? Can I still do this once I have installed drupal 7? How do I check whether its been salted? (I am sorry I am asking so many questions but seems like there is something wrong with stackexchange editing program, as I cannot edit properly right now)
    – Minty
    Nov 24, 2011 at 13:51
  • I updated that article to describe how to address use that file a bit more and expanded my answer here. It's hard to answer too much more without writing a whole book! ;)
    – greggles
    Dec 2, 2011 at 17:55
  • Sadly, greggles, your article is now MIA, lost in some website transition. Is it still available anywhere? I'm finally doing one of my last and most important D7 upgrades.
    – rfay
    May 8, 2015 at 18:18
  • Thanks for asking rfay and wongataa. I've updated the link to a new, freely accessible home for that creative-commons licensed content :)
    – greggles
    Jul 1, 2015 at 22:03
0

@rfay the Wayback Machine has us covered: https://web.archive.org/web/20131018191043/http://drupalscout.com/knowledge-base/improvements-security-drupal-7

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.