fix(auth): upgrade SFTP password hash from MD5-crypt to SHA-512 and tighten auth.env permissions

- Replace openssl passwd -1 (MD5-crypt) with -6 (SHA-512-crypt) for SFTP credential
- Change auth.env file permissions from 0644 to 0600 (owner read/write only)
- Update .justfile, docs, and argparse help string to reflect new hash algorithm

Author: mmguero

.justfile

@@ -216,7 +216,7 @@ auth-setup:
     --auth-generate-postgres-password "${AUTH_GENERATE_POSTGRES_PASSWORD:-false}" \
     --auth-generate-keycloak-db-password "${AUTH_GENERATE_KEYCLOAK_DB_PASSWORD:-true}" \
     --auth-admin-username "${AUTH_ADMIN_USERNAME}" \
-    --auth-admin-password-openssl "$(echo -n "${AUTH_ADMIN_PASSWORD}" | openssl passwd -1 --stdin)" \
+    --auth-admin-password-openssl "$(echo -n "${AUTH_ADMIN_PASSWORD}" | openssl passwd -6 --stdin)" \
     --auth-admin-password-htpasswd "$(echo -n "${AUTH_ADMIN_PASSWORD}" | htpasswd -i -n -B username | cut -d: -f2 | head -n 1)" \
     --auth-arkime-password "${AUTH_ARKIME_PASSWORD:-Malcolm}" \
     --auth-generate-webcerts "${AUTH_GENERATE_WEBCERTS:-true}" \

docs/authsetup.md

@@ -492,7 +492,7 @@ Authentication Setup:
   --auth-admin-username <string>
                         Administrator username (for --auth-noninteractive)
   --auth-admin-password-openssl <string>
-                        Administrator password hash from "openssl -passwd -1" (for --auth-noninteractive)
+                        Administrator password hash from "openssl -passwd -6" (for --auth-noninteractive)
   --auth-admin-password-htpasswd <string>
                         Administrator password hash from "htpasswd -n -B username | cut -d: -f2" (for --auth-noninteractive)
   --auth-arkime-password <string>
@@ -536,7 +536,7 @@ Authentication Setup:
 …
 ```
 
-In order to avoid specifying passwords as command line arguments, when setting the administrator password noninteractively the user must instead provide hashes generated by [`openssl -passwd -1`](https://www.openssl.org/docs/man1.1.1/man1/openssl-passwd.html) and [`htpasswd -n -B username`](https://httpd.apache.org/docs/2.4/programs/htpasswd.html).
+In order to avoid specifying passwords as command line arguments, when setting the administrator password noninteractively the user must instead provide hashes generated by [`openssl -passwd -6`](https://www.openssl.org/docs/man1.1.1/man1/openssl-passwd.html) and [`htpasswd -n -B username`](https://httpd.apache.org/docs/2.4/programs/htpasswd.html).
 
 # <a name="LoggingOut"></a>Log Out of Malcolm
 

scripts/control.py

@@ -2111,7 +2111,7 @@ def authSetup():
                         passwordEncrypted = args.authPasswordOpenssl
                     else:
                         err, out = run_process(
-                            [opensslBin, 'passwd', '-1', '-stdin'],
+                            [opensslBin, 'passwd', '-6', '-stdin'],
                             stdin=password,
                             stderr=False,
                             debug=log_level_is_debug(args.verbose),
@@ -2137,7 +2137,7 @@ def authSetup():
                                 b64encode(passwordEncrypted.encode()).decode("ascii"),
                             ),
                         ],
-                        stat.S_IRUSR | stat.S_IWUSR | stat.S_IRGRP | stat.S_IROTH,
+                        stat.S_IRUSR | stat.S_IWUSR,
                     )
 
                     # create or update the htpasswd file
@@ -3290,7 +3290,7 @@ def main():
         metavar='<string>',
         type=str,
         default='',
-        help='Administrator password hash from "openssl -passwd -1" (for --auth-noninteractive)',
+        help='Administrator password hash from "openssl -passwd -6" (for --auth-noninteractive)',
     )
     authSetupGroup.add_argument(
         '--auth-admin-password-htpasswd',