<![CDATA[Insecure KDF iterations settings]]>Vaultwarden is installed by default with non-secure kdf iterations settings - would you please, set it up to 600.000 as a minimum please? Ideally - have it set up till 2.000.000

]]>https://forum.cloudron.io/topic/13111/insecure-kdf-iterations-settingsRSS for NodeWed, 19 Aug 2026 18:00:10 GMTMon, 13 Jan 2025 09:49:07 GMT60<![CDATA[Reply to Insecure KDF iterations settings on Wed, 15 Jan 2025 20:25:01 GMT]]>@necrevistonnezr my installation is quite old - that's correct. Thanks for checking in!

@girish , thank you for the doc's reference! Guess it might make sense to stress that during the installation, as well as an offer to increase KDF up to 2 mln (as per Bitwarden docs as well).

]]>https://forum.cloudron.io/post/100046https://forum.cloudron.io/post/100046Wed, 15 Jan 2025 20:25:01 GMT<![CDATA[Reply to Insecure KDF iterations settings on Mon, 13 Jan 2025 10:43:47 GMT]]>@necrevistonnezr said in Insecure KDF iterations settings:

The default Cloudron install (now) has even 600k, not only 60k.

ah, even in my screenshot it is 600k. I misread it!

]]>https://forum.cloudron.io/post/99884https://forum.cloudron.io/post/99884Mon, 13 Jan 2025 10:43:47 GMT<![CDATA[Reply to Insecure KDF iterations settings on Mon, 13 Jan 2025 10:37:40 GMT]]>@girish said in Insecure KDF iterations settings:

The default install has 60k, so maybe I am missing something with this report.

The default Cloudron install (now) has even 600k, not only 60k.
But I think it wasn't always like this (see https://forum.cloudron.io/topic/11194/vaultwarden-security-enhancement-tip/) and @potemkin_ai has an old install?

]]>https://forum.cloudron.io/post/99882https://forum.cloudron.io/post/99882Mon, 13 Jan 2025 10:37:40 GMT<![CDATA[Reply to Insecure KDF iterations settings on Mon, 13 Jan 2025 10:30:22 GMT]]>@potemkin_ai said in Insecure KDF iterations settings:

Admin token - which enables full access - is indeed stored plain text and accessible for cloudron admin.

I think you have to regenerate it like https://docs.cloudron.io/apps/vaultwarden/#admin which already uses argon

]]>https://forum.cloudron.io/post/99879https://forum.cloudron.io/post/99879Mon, 13 Jan 2025 10:30:22 GMT<![CDATA[Reply to Insecure KDF iterations settings on Mon, 13 Jan 2025 10:44:00 GMT]]>The default install has 600k, so maybe I am missing something with this report.

image.png

]]>https://forum.cloudron.io/post/99877https://forum.cloudron.io/post/99877Mon, 13 Jan 2025 10:44:00 GMT<![CDATA[Reply to Insecure KDF iterations settings on Mon, 13 Jan 2025 10:23:13 GMT]]>In my server atleast, config.json has

  "password_iterations": 600000,

I don't remember changing this

]]>https://forum.cloudron.io/post/99876https://forum.cloudron.io/post/99876Mon, 13 Jan 2025 10:23:13 GMT<![CDATA[Reply to Insecure KDF iterations settings on Mon, 13 Jan 2025 10:14:16 GMT]]>here is an official doc, just in case: https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page#secure-the-admin_token

]]>https://forum.cloudron.io/post/99872https://forum.cloudron.io/post/99872Mon, 13 Jan 2025 10:14:16 GMT<![CDATA[Reply to Insecure KDF iterations settings on Mon, 13 Jan 2025 09:58:40 GMT]]>One more thing:

You are using a plain text ADMIN_TOKEN which is insecure.
Please generate a secure Argon2 PHC string by using vaultwarden hash or argon2.

Admin token - which enables full access - is indeed stored plain text and accessible for cloudron admin.

]]>https://forum.cloudron.io/post/99866https://forum.cloudron.io/post/99866Mon, 13 Jan 2025 09:58:40 GMT<![CDATA[Reply to Insecure KDF iterations settings on Mon, 13 Jan 2025 09:57:50 GMT]]>@jdaviescoates it was not in case of my server setup, and I didn't touch a thing since it was installed!

]]>https://forum.cloudron.io/post/99865https://forum.cloudron.io/post/99865Mon, 13 Jan 2025 09:57:50 GMT<![CDATA[Reply to Insecure KDF iterations settings on Mon, 13 Jan 2025 09:51:28 GMT]]>@potemkin_ai said in Insecure KDF iterations settings:

600.000 as a minimum please?

Yeah, is the default on Bitwarden according to https://bitwarden.com/help/kdf-algorithms/

]]>https://forum.cloudron.io/post/99861https://forum.cloudron.io/post/99861Mon, 13 Jan 2025 09:51:28 GMT