# Hash algo to use with file realm **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [June 3, 2021, 5:51pm UTC](https://discuss.elastic.co/t/hash-algo-to-use-with-file-realm/274905 "2021-06-03T17:51:35Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![ebuildy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ebuildy/32/6070_2.png) [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Post date:** [June 3, 2021, 5:51pm UTC](https://discuss.elastic.co/t/hash-algo-to-use-with-file-realm/274905/1 "2021-06-03T17:51:36Z")
Using ES 7.13.0 , platinium licence, security enabled. Using [File-based user authentication | Elasticsearch Guide [7.13] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/file-realm.html). I am trying to setup "users" file, with username:password. **What is exactly the hash algo to use?** I tried bcrypt from Php / Ansible (Python 3) or even online with [https://bcrypt-generator.com/](https://bcrypt-generator.com/) , this never work . It's working fine using `elasticsearch-user useradd` CLI. Looking at the code here [elasticsearch/BCrypt.java at master · elastic/elasticsearch · GitHub](https://github.com/elastic/elasticsearch/blob/master/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authc/support/BCrypt.java), it looks a home made algo? ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [June 3, 2021, 11:59pm UTC](https://discuss.elastic.co/t/hash-algo-to-use-with-file-realm/274905/2 "2021-06-03T23:59:30Z")
The bcrypt implementation is compatible with other implementations. Specifically, it is compatible with Python and whatever used for [https://bcrypt-generator.com](https://bcrypt-generator.com) For example, the following works in Python (hash value copied from `users` file): ```python import bcrypt bcrypt.checkpw(b'password', b'$2a$10$EAxS6KaU2x3pQGZn/i4ldu5pVDAdUiaG7UZU9I2H..6N2WMF2KXoe') ``` The above works for [https://bcrypt-generator.com](https://bcrypt-generator.com/) as well. Note you need to choose `Decrypt` for checking. Bcrypt generates different hash each time for the same password because it uses salt to prevent rainbow table attack. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [June 4, 2021, 5:46am UTC](https://discuss.elastic.co/t/hash-algo-to-use-with-file-realm/274905/3 "2021-06-04T05:46:14Z")
That online bcrypt generator is using a non-standard format. `$2y$` is a commonly used, but non-standard, prefix that was decided on by a number of tools to work around previous bugs in their implementations. We currently only accept the standard, canonical prefix of `$2a$` We're likely to change our implementation to support `$2y$` in order to be more compatible, but it's not a priority. > > > \*\*Elasticsearch version\*\*: 7.5.1 > > \*\*Plugins installed\*\*: none > > \*\*JVM ver…sion\*\*: 13.0.1 > > \*\*OS version\*\* : Ubuntu 18.04.3 LTS > > \*\*Description of the problem including expected versus actual behavior\*\*: > > Attempting to use a 2y password\_hash to create a user via the \`\_security\` API results in an error > > Bcrypt \`2a\` and \`2y\` hashes generated by modern tools are functionally identical so I feel that this is a bug. Ubuntu htpasswd, for instance emits \`2y\` hashes which are not accepted by the API. Attempting to POST a \`2y\` bcrypt hash results in an error: \`hash uses \[NOOP\]\`. > > Simply changing the hash prefix to 2a works, however this means that \*generated hashes (e.g., by scripts) can not be posted to the API without first being modified\*. > > Expected behaviour: The API should accept valid \`2y\` bcrypt hashes. > > \*\*Steps to reproduce\*\*: > > 1. Create a bcrypt hash with \`htpasswd\`: > \`\`\` > $ htpasswd -nBC10 test > New password: \<-- test > Re-type new password: > test:$2y$10$4KUQQvcSYBaQTWUP84ToX.N7CwwgPAT7d0JXofUyH8cH4LuFfT/Y6 > \`\`\` > > 2. Attempt to create a new user via the \_security/user endpoint, using the hash generated in step (1.) > > \`\`\` > POST /\_security/user/test > { > "password\_hash" : "$2y$10$4KUQQvcSYBaQTWUP84ToX.N7CwwgPAT7d0JXofUyH8cH4LuFfT/Y6", > "roles": "some\_role" > } > > { > "error": { > "root\_cause": \[ > { > "type": "illegal\_argument\_exception", > "reason": "Provided password hash uses \[NOOP\] but the configured hashing algorithm is \[BCRYPT\]" > } > \], > "type": "illegal\_argument\_exception", > "reason": "Provided password hash uses \[NOOP\] but the configured hashing algorithm is \[BCRYPT\]" > }, > "status": 400 > } > \`\`\` > 2. Change the hash prefix to \`2a\`: > \`\`\` > POST /\_security/user/test > { > "password\_hash" : "$2a$10$4KUQQvcSYBaQTWUP84ToX.N7CwwgPAT7d0JXofUyH8cH4LuFfT/Y6", > "roles": "some\_role" > } > > { > "created" : true > } > \`\`\` However, putting all of that aside, we don't support generating your own `users` file. We provide a tool and that is the only supported way to manage those files. ---
**Author:** ![ebuildy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ebuildy/32/6070_2.png) [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Post date:** [June 4, 2021, 7:49am UTC](https://discuss.elastic.co/t/hash-algo-to-use-with-file-realm/274905/4 "2021-06-04T07:49:56Z")
yes this is what I understand now. Very hard to use with prov. tool such as Ansible / Chef 😕 Thanks you ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 2, 2021, 7:50am UTC](https://discuss.elastic.co/t/hash-algo-to-use-with-file-realm/274905/5 "2021-07-02T07:50:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.