Werk #14380: Improve security of password hashes in audit log

Component	Setup
Title	Improve security of password hashes in audit log
Date	Jul 18, 2022
Level	Trivial Change
Class	Security Fix
Compatibility	Compatible - no manual interaction needed
Checkmk versions & editions	2.1.0p9 Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME) 2.0.0p28 Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME)

Hashes of passwords displayed in the audit log are now calculated using a keyed hash function.

Previously, a truncated SHA256 hash of the password was displayed. While this is not an issue for long, randomly generated passwords, the hashes of weak passwords could have been reversed using brute-force. Passwords are now hashed using HMAC with a random key that is not persisted. Note that, as a consequence, users will not be able to recognize or validate password hashes in the audit log.

To the list of all Werks