Page MenuHomePhabricator

Deploy MediaWiki config change to use OpenSSL for PBKDF2 password hashing
Closed, ResolvedPublic

Description

Since rMW47241a3520d5b4bf, MediaWiki core by default now uses OpenSSL when available for creating and verifying type "pbkdf2" password hashes. This is more efficient and would allow for a significant increase in the number of PBKDF2 iterations if desired (see T234987). However, the way the core change was implemented means that Wikimedia sites still use PHP's hash extension for this purpose. CommonSettings.php specifies that the class "Pbkdf2Password" be used, and for compatibility reasons, that class name refers to "Pbkdf2PasswordUsingHashExtension" rather than any implementation that uses OpenSSL.

https://gerrit.wikimedia.org/r/c/operations/mediawiki-config/+/842522 would change CommonSettings.php to instead reference the new class "Pbkdf2PasswordUsingOpenSSL". @Urbanecm said on IRC that deployment of this change should be coordinated with SRE. So I am filing this task to request SRE assistance with the deployment.

Note that even if we decide to switch to a different password hashing function such as Argon2id (see T216682), I think this config change should still be deployed in order to verify that the OpenSSL code path works in production, since that is what would be used if the Wikimedia-specific configuration for type "pbkdf2" were to be removed from CommonSettings.php.

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Change 842522 had a related patch set uploaded (by PleaseStand; author: PleaseStand):

[operations/mediawiki-config@master] Use OpenSSL for PBKDF2 password hashing

https://gerrit.wikimedia.org/r/842522

@Urbanecm please clarify what part of this change do you want SRE to coordinate :)

@Urbanecm please clarify what part of this change do you want SRE to coordinate :)

For context, here are the relevant messages from the #wikimedia-operations IRC log:

2022-10-17 07:25:31 <urbanecm> hi PleaseStand, sorry, i missed the start of the window
2022-10-17 07:25:35 <urbanecm> did someone start deploying already?
2022-10-17 07:25:59 <PleaseStand> urbanecm: no?
2022-10-17 07:28:10 <urbanecm> PleaseStand: okay. actually, in this case, i think it'd be great to coordinate the deployment closely with SREs, to ensure it doesn't result in an accident. changing PW hashing is potentially dangerous
2022-10-17 07:29:35 <PleaseStand> urbanecm: Fine with me, no big hurry, should I file a Phabricator task and tag SRE?
2022-10-17 07:29:51 <urbanecm> PleaseStand: yeah, that's a great first step.

I'm also not sure what exactly SRE could do to "ensure it doesn't result in an accident", though at the very least, since the patch was turned down for deployment during a backport window, it should be deployed in a dedicated window.

I am not sure what type of coordination is needed from SRE either. Maybe just making sure that 1 or 2 SREs are around when the patch is deployed? Can't see anything else right now.

Change #1027337 had a related patch set uploaded (by Zabe; author: Zabe):

[operations/mediawiki-config@master] beta: Use OpenSSL for PBKDF2 password hashing

https://gerrit.wikimedia.org/r/1027337

Change #1027337 merged by jenkins-bot:

[operations/mediawiki-config@master] beta: Use OpenSSL for PBKDF2 password hashing

https://gerrit.wikimedia.org/r/1027337

Change #1028756 had a related patch set uploaded (by Zabe; author: Zabe):

[operations/mediawiki-config@master] Use OpenSSL for PBKDF2 password hashing on testwiki

https://gerrit.wikimedia.org/r/1028756

Change #1028756 merged by jenkins-bot:

[operations/mediawiki-config@master] Use OpenSSL for PBKDF2 password hashing on testwiki

https://gerrit.wikimedia.org/r/1028756

Mentioned in SAL (#wikimedia-operations) [2024-05-07T08:17:20Z] <zabe@deploy1002> Started scap: Backport for [[gerrit:1028756|Use OpenSSL for PBKDF2 password hashing on testwiki (T320929)]]

Mentioned in SAL (#wikimedia-operations) [2024-05-07T08:19:44Z] <zabe@deploy1002> zabe: Backport for [[gerrit:1028756|Use OpenSSL for PBKDF2 password hashing on testwiki (T320929)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2024-05-07T08:34:43Z] <zabe@deploy1002> Finished scap: Backport for [[gerrit:1028756|Use OpenSSL for PBKDF2 password hashing on testwiki (T320929)]] (duration: 17m 22s)

Change #842522 merged by jenkins-bot:

[operations/mediawiki-config@master] Use OpenSSL for PBKDF2 password hashing

https://gerrit.wikimedia.org/r/842522

Mentioned in SAL (#wikimedia-operations) [2024-05-07T20:58:41Z] <zabe@deploy1002> Started scap: Backport for [[gerrit:842522|Use OpenSSL for PBKDF2 password hashing (T320929)]]

Mentioned in SAL (#wikimedia-operations) [2024-05-07T21:01:15Z] <zabe@deploy1002> zabe and ki: Backport for [[gerrit:842522|Use OpenSSL for PBKDF2 password hashing (T320929)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2024-05-07T21:15:56Z] <zabe@deploy1002> Finished scap: Backport for [[gerrit:842522|Use OpenSSL for PBKDF2 password hashing (T320929)]] (duration: 17m 14s)

Zabe claimed this task.