What are the different methods used for encrypting passwords used in database exports. See the Resolution section for more.

 

If I have a text opscode_chef database export on a backend or standalone, as would be made by

sudo su - chef-pgsql/opscode-pgsql; pg_dumpall > chef-databases.sql

 

Here is an opscode_chef user in a postgresql instance's database export. Notice the md5 preamble in the hash. That is not part of the hashed password, the rest is 7aec6208faa701225a5fc326d7c49635, which should match a plain-text password we know from the frontends

ALTER ROLE opscode_chef WITH NOSUPERUSER INHERIT NOCREATEROLE NOCREATEDB LOGIN NOREPLICATION NOBYPASSRLS PASSWORD 'md57aec6208faa701225a5fc326d7c49635';

 

Let’s see if we know a password that matches. We want to make sure our frontend has the correct password set in its Veiled password database, say. I can do the following to compare the passwords shown in password+seeded_username hashed into md5 format in the database export vs. the actual plain-text password

opscode_erchef in a frontend's Veiled password database == opscode_chef user in a backend/standalone postgresql instance. We choose the opscode_erchef: {sql_password} example and test if it could be the password+username that produces the hash in the database export. We echoed the plain-text password+username we are testing WITH NO LINE FEED into the md5sum program to see what md5 hash that combination makes. Turns out, the password from the frontend does match the password stored in the postgresql database for that username. Success!

/opt/opscode/embedded/bin/veil-dump-secrets /etc/opscode/private-chef-secrets.json | python -mjson.tool | grep -A 2 erchef
"opscode_erchef": {
"sql_password": "33fd0fd6aab6fe1f7e96faedfce00c924d93efe30e492cab3830bdab3016",

#Hey, look at that, it's the same plain-text password from our frontend! So, that frontend should be able to communicate with this postgres instance as the opscode_chef user. Notice the concatenation of the plain-text password and username, as I mentioned earlier

echo -n "33fd0fd6aab6fe1f7e96faedfce00c924d93efe30e492cab3830bdab3016opscode_chef" | md5sum
7aec6208faa701225a5fc326d7c49635 -