Invalid Admin Token

[yuljk]

Hi - I'm running the latest deb package on Debian 12 and have generated an argon2 admin token as per the instructions on the wiki. I then pasted the hash to /etc/vaultwarden/config.env as per:-

Token for the admin interface, preferably use a long random string

One option is to use 'openssl rand -base64 48'

If not set, the admin panel is disabled

ADMIN_TOKEN='$argon2id$v=19$m=19456,t=2,p=1$UUlqa1RONktWU2VyRWM2NmkwNVI4VWlZYm8weE5JWnA4aDZ2NlBZUzEvRT0$Pnwqjn/Q1gDOz9G0GXz8TyNCwZ/w2TA0VLS4C6Uz0Vo'

However after saving config.env and temmpting to login to the admin portal with the generated hash I receive "Error: Invalid admin token, please try again."

The logs show

[2024-04-08 10:39:05.873][request][INFO] POST /admin
[2024-04-08 10:39:06.054][vaultwarden::api::admin][ERROR] Invalid admin token. IP: someip
[2024-04-08 10:39:06.055][response][INFO] (post_admin_login) POST /admin/ => 401 Unauthorized

I presume the hash needs single quotes in config.env? - I've tried with or without.

I ran this to generate the hash with argon2

echo -n "somepass" | argon2 "$(openssl rand -base64 32)" -e -id -k 65540 -t 3 -p 4

Many thanks!

[stefan0xC]

Have you used somepass to login or really the generated hash? The latter won't work. Because the idea behind securing the token by hashing is so that the password is not stored in plain text anymore.
Cf. https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html

[yuljk]

Hi - I used the hash. Weirdly, this was working a few versions back, so not sure what has changed.

I'm building the dpkg from https://github.com/greizgh/vaultwarden-debian for each upgrade.

[stefan0xC]

Weirdly, this was working a few versions back, so not sure what has changed.

Not sure what version you were using or what you mean with "this was working" exactly, because I kinda doubt you had set an actual PHC string before as your admin token.

What changed was that Vaultwarden did not use to show this warning previously

[NOTICE] You are using a plain text `ADMIN_TOKEN` which is insecure.
Please generate a secure Argon2 PHC string by using `vaultwarden hash` or `argon2`.
See: https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page#secure-the-admin_token

Like the wiki page says support for this was added in v1.28.0 (cf. #3289).