mirror/postgresql
2
0
Fork 0
mirror of https://git.postgresql.org/git/postgresql.git synced 2025-03-13 19:57:53 +08:00
Code Issues Packages Projects Releases Wiki Activity

Change default of password_encryption to scram-sha-256

Browse Source 
Also, the legacy values on/true/yes/1 for password_encryption that
mapped to md5 are removed.  The only valid values are now
scram-sha-256 and md5.

Reviewed-by: Jonathan S. Katz <jkatz@postgresql.org>
Discussion: https://www.postgresql.org/message-id/flat/d5b0ad33-7d94-bdd1-caac-43a1c782cab2%402ndquadrant.com
This commit is contained in:
Peter Eisentraut 2020-06-10 16:16:37 +02:00
parent 5a4ada71a8
commit c7eab0e97e
7 changed files with 23 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
doc/src/sgml/config.sgml
View File

@ -1013,11 +1013,11 @@ include_dir 'conf.d'
<listitem>
<para>
When a password is specified in <xref linkend="sql-createrole"/> or
<xref linkend="sql-alterrole"/>, this parameter determines the algorithm
to use to encrypt the password. The default value is <literal>md5</literal>,
which stores the password as an MD5 hash (<literal>on</literal> is also
accepted, as alias for <literal>md5</literal>). Setting this parameter to
<literal>scram-sha-256</literal> will encrypt the password with SCRAM-SHA-256.
<xref linkend="sql-alterrole"/>, this parameter determines the
algorithm to use to encrypt the password. Possible values are
<literal>scram-sha-256</literal>, which will encrypt the password with
SCRAM-SHA-256, and <literal>md5</literal>, which stores the password
as an MD5 hash. The default is <literal>scram-sha-256</literal>.
</para>
<para>
Note that older clients might lack support for the SCRAM authentication

2
src/backend/commands/user.c
View File

@ -43,7 +43,7 @@ Oid binary_upgrade_next_pg_authid_oid = InvalidOid;
/* GUC parameter */
int Password_encryption = PASSWORD_TYPE_MD5;
int Password_encryption = PASSWORD_TYPE_SCRAM_SHA_256;
/* Hook to check passwords in CreateRole() and AlterRole() */
check_password_hook_type check_password_hook = NULL;

11
src/backend/utils/misc/guc.c
View File

@ -463,18 +463,9 @@ static const struct config_enum_entry plan_cache_mode_options[] = {
{NULL, 0, false}
};
/*
* password_encryption used to be a boolean, so accept all the likely
* variants of "on", too. "off" used to store passwords in plaintext,
* but we don't support that anymore.
*/
static const struct config_enum_entry password_encryption_options[] = {
{"md5", PASSWORD_TYPE_MD5, false},
{"scram-sha-256", PASSWORD_TYPE_SCRAM_SHA_256, false},
{"on", PASSWORD_TYPE_MD5, true},
{"true", PASSWORD_TYPE_MD5, true},
{"yes", PASSWORD_TYPE_MD5, true},
{"1", PASSWORD_TYPE_MD5, true},
{NULL, 0, false}
};
@ -4733,7 +4724,7 @@ static struct config_enum ConfigureNamesEnum[] =
NULL
},
&Password_encryption,
PASSWORD_TYPE_MD5, password_encryption_options,
PASSWORD_TYPE_SCRAM_SHA_256, password_encryption_options,
NULL, NULL, NULL
},

2
src/backend/utils/misc/postgresql.conf.sample
View File

@ -88,7 +88,7 @@
# - Authentication -
#authentication_timeout = 1min # 1s-600s
#password_encryption = md5 # md5 or scram-sha-256
#password_encryption = scram-sha-256 # scram-sha-256 or md5
#db_user_namespace = off
# GSSAPI using Kerberos

21
src/bin/initdb/initdb.c
View File

@ -1204,12 +1204,18 @@ setup_config(void)
"#update_process_title = off");
#endif
if (strcmp(authmethodlocal, "scram-sha-256") == 0 ||
strcmp(authmethodhost, "scram-sha-256") == 0)
/*
* Change password_encryption setting to md5 if md5 was chosen as an
* authentication method, unless scram-sha-256 was also chosen.
*/
if ((strcmp(authmethodlocal, "md5") == 0 &&
strcmp(authmethodhost, "scram-sha-256") != 0) ||
(strcmp(authmethodhost, "md5") == 0 &&
strcmp(authmethodlocal, "scram-sha-256") != 0))
{
conflines = replace_token(conflines,
"#password_encryption = md5",
"password_encryption = scram-sha-256");
"#password_encryption = scram-sha-256",
"password_encryption = md5");
}
/*
@ -2373,12 +2379,7 @@ check_need_password(const char *authmethodlocal, const char *authmethodhost)
strcmp(authmethodhost, "scram-sha-256") == 0) &&
!(pwprompt || pwfilename))
{
pg_log_error("must specify a password for the superuser to enable %s authentication",
(strcmp(authmethodlocal, "md5") == 0 ||
strcmp(authmethodlocal, "password") == 0 ||
strcmp(authmethodlocal, "scram-sha-256") == 0)
? authmethodlocal
: authmethodhost);
pg_log_error("must specify a password for the superuser to enable password authentication");
exit(1);
}
}

5
src/test/regress/expected/password.out
View File

@ -5,13 +5,14 @@
SET password_encryption = 'novalue'; -- error
ERROR: invalid value for parameter "password_encryption": "novalue"
HINT: Available values: md5, scram-sha-256.
SET password_encryption = true; -- ok
SET password_encryption = true; -- error
ERROR: invalid value for parameter "password_encryption": "true"
HINT: Available values: md5, scram-sha-256.
SET password_encryption = 'md5'; -- ok
SET password_encryption = 'scram-sha-256'; -- ok
-- consistency of password entries
SET password_encryption = 'md5';
CREATE ROLE regress_passwd1 PASSWORD 'role_pwd1';
SET password_encryption = 'on';
CREATE ROLE regress_passwd2 PASSWORD 'role_pwd2';
SET password_encryption = 'scram-sha-256';
CREATE ROLE regress_passwd3 PASSWORD 'role_pwd3';

3
src/test/regress/sql/password.sql
View File

@ -4,14 +4,13 @@
-- Tests for GUC password_encryption
SET password_encryption = 'novalue'; -- error
SET password_encryption = true; -- ok
SET password_encryption = true; -- error
SET password_encryption = 'md5'; -- ok
SET password_encryption = 'scram-sha-256'; -- ok
-- consistency of password entries
SET password_encryption = 'md5';
CREATE ROLE regress_passwd1 PASSWORD 'role_pwd1';
SET password_encryption = 'on';
CREATE ROLE regress_passwd2 PASSWORD 'role_pwd2';
SET password_encryption = 'scram-sha-256';
CREATE ROLE regress_passwd3 PASSWORD 'role_pwd3';