use openssl secure_password, move attributes to databag entries