How to set up salt hash while installing Drupal 7? I am no expert in salt hash but while I was installing Acquia Dev, I noticed a variable $drupal_hash_salt, filled with a randomly generated string, in settings.php of newly installed Drupal 7 and a file called .hashlist under root drupal installation folder. Can someone help me understand the salting concepts in Drupal 7?

When I tried to import a new version of Drupal 7 site, I could not see any random string in that same variable and also no .hashlist file. I may be doing something wrong here. I tried googling around to see if I could find something useful but no luck.

So I have 3 questions


How to do salt hashing in Drupal 7 during/before installation process?
What kinds of data are being hashed (other than password)?
How can I extend this salting concept further?


Thanks a lot in advance.
I talk a bit about the new salts in my article on Improvements to Security in Drupal 7 which may help answer these questions.

Depending on when you need the salt you might be able to use drupal_get_hash_salt or you may be able to leverage the code it uses to create your hash.

Can you expand on "extend this salting concept" ?  What kind of extension do you want to do?

Salting is a standard part of hashing. You can read about salting on the php hashing pages. Changing your salt after the site is live may cause some problems in specific areas. My guess is that it depends on which modules you have installed and which features you are using. The one-time-login links are likely to stop working, but I'm not sure of other specific functionality that would stop.