From c7eab0e97e6cf1d0c136c22269c10ae11ba874c4 Mon Sep 17 00:00:00 2001 From: Peter Eisentraut Date: Wed, 10 Jun 2020 16:16:37 +0200 Subject: [PATCH] Change default of password_encryption to scram-sha-256 Also, the legacy values on/true/yes/1 for password_encryption that mapped to md5 are removed. The only valid values are now scram-sha-256 and md5. Reviewed-by: Jonathan S. Katz Discussion: https://www.postgresql.org/message-id/flat/d5b0ad33-7d94-bdd1-caac-43a1c782cab2%402ndquadrant.com --- doc/src/sgml/config.sgml | 10 ++++----- src/backend/commands/user.c | 2 +- src/backend/utils/misc/guc.c | 11 +--------- src/backend/utils/misc/postgresql.conf.sample | 2 +- src/bin/initdb/initdb.c | 21 ++++++++++--------- src/test/regress/expected/password.out | 5 +++-- src/test/regress/sql/password.sql | 3 +-- 7 files changed, 23 insertions(+), 31 deletions(-) diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml index aca8f73a50..2908821560 100644 --- a/doc/src/sgml/config.sgml +++ b/doc/src/sgml/config.sgml @@ -1013,11 +1013,11 @@ include_dir 'conf.d' When a password is specified in or - , this parameter determines the algorithm - to use to encrypt the password. The default value is md5, - which stores the password as an MD5 hash (on is also - accepted, as alias for md5). Setting this parameter to - scram-sha-256 will encrypt the password with SCRAM-SHA-256. + , this parameter determines the + algorithm to use to encrypt the password. Possible values are + scram-sha-256, which will encrypt the password with + SCRAM-SHA-256, and md5, which stores the password + as an MD5 hash. The default is scram-sha-256. Note that older clients might lack support for the SCRAM authentication diff --git a/src/backend/commands/user.c b/src/backend/commands/user.c index 1ef00d6e89..9ce9a66921 100644 --- a/src/backend/commands/user.c +++ b/src/backend/commands/user.c @@ -43,7 +43,7 @@ Oid binary_upgrade_next_pg_authid_oid = InvalidOid; /* GUC parameter */ -int Password_encryption = PASSWORD_TYPE_MD5; +int Password_encryption = PASSWORD_TYPE_SCRAM_SHA_256; /* Hook to check passwords in CreateRole() and AlterRole() */ check_password_hook_type check_password_hook = NULL; diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c index 17c15348ef..28b2fc72d6 100644 --- a/src/backend/utils/misc/guc.c +++ b/src/backend/utils/misc/guc.c @@ -463,18 +463,9 @@ static const struct config_enum_entry plan_cache_mode_options[] = { {NULL, 0, false} }; -/* - * password_encryption used to be a boolean, so accept all the likely - * variants of "on", too. "off" used to store passwords in plaintext, - * but we don't support that anymore. - */ static const struct config_enum_entry password_encryption_options[] = { {"md5", PASSWORD_TYPE_MD5, false}, {"scram-sha-256", PASSWORD_TYPE_SCRAM_SHA_256, false}, - {"on", PASSWORD_TYPE_MD5, true}, - {"true", PASSWORD_TYPE_MD5, true}, - {"yes", PASSWORD_TYPE_MD5, true}, - {"1", PASSWORD_TYPE_MD5, true}, {NULL, 0, false} }; @@ -4733,7 +4724,7 @@ static struct config_enum ConfigureNamesEnum[] = NULL }, &Password_encryption, - PASSWORD_TYPE_MD5, password_encryption_options, + PASSWORD_TYPE_SCRAM_SHA_256, password_encryption_options, NULL, NULL, NULL }, diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sample index ac02bd0c00..3a25287a39 100644 --- a/src/backend/utils/misc/postgresql.conf.sample +++ b/src/backend/utils/misc/postgresql.conf.sample @@ -88,7 +88,7 @@ # - Authentication - #authentication_timeout = 1min # 1s-600s -#password_encryption = md5 # md5 or scram-sha-256 +#password_encryption = scram-sha-256 # scram-sha-256 or md5 #db_user_namespace = off # GSSAPI using Kerberos diff --git a/src/bin/initdb/initdb.c b/src/bin/initdb/initdb.c index 5a787681f9..786672b1b6 100644 --- a/src/bin/initdb/initdb.c +++ b/src/bin/initdb/initdb.c @@ -1204,12 +1204,18 @@ setup_config(void) "#update_process_title = off"); #endif - if (strcmp(authmethodlocal, "scram-sha-256") == 0 || - strcmp(authmethodhost, "scram-sha-256") == 0) + /* + * Change password_encryption setting to md5 if md5 was chosen as an + * authentication method, unless scram-sha-256 was also chosen. + */ + if ((strcmp(authmethodlocal, "md5") == 0 && + strcmp(authmethodhost, "scram-sha-256") != 0) || + (strcmp(authmethodhost, "md5") == 0 && + strcmp(authmethodlocal, "scram-sha-256") != 0)) { conflines = replace_token(conflines, - "#password_encryption = md5", - "password_encryption = scram-sha-256"); + "#password_encryption = scram-sha-256", + "password_encryption = md5"); } /* @@ -2373,12 +2379,7 @@ check_need_password(const char *authmethodlocal, const char *authmethodhost) strcmp(authmethodhost, "scram-sha-256") == 0) && !(pwprompt || pwfilename)) { - pg_log_error("must specify a password for the superuser to enable %s authentication", - (strcmp(authmethodlocal, "md5") == 0 || - strcmp(authmethodlocal, "password") == 0 || - strcmp(authmethodlocal, "scram-sha-256") == 0) - ? authmethodlocal - : authmethodhost); + pg_log_error("must specify a password for the superuser to enable password authentication"); exit(1); } } diff --git a/src/test/regress/expected/password.out b/src/test/regress/expected/password.out index 2b852aa324..7c84c9da33 100644 --- a/src/test/regress/expected/password.out +++ b/src/test/regress/expected/password.out @@ -5,13 +5,14 @@ SET password_encryption = 'novalue'; -- error ERROR: invalid value for parameter "password_encryption": "novalue" HINT: Available values: md5, scram-sha-256. -SET password_encryption = true; -- ok +SET password_encryption = true; -- error +ERROR: invalid value for parameter "password_encryption": "true" +HINT: Available values: md5, scram-sha-256. SET password_encryption = 'md5'; -- ok SET password_encryption = 'scram-sha-256'; -- ok -- consistency of password entries SET password_encryption = 'md5'; CREATE ROLE regress_passwd1 PASSWORD 'role_pwd1'; -SET password_encryption = 'on'; CREATE ROLE regress_passwd2 PASSWORD 'role_pwd2'; SET password_encryption = 'scram-sha-256'; CREATE ROLE regress_passwd3 PASSWORD 'role_pwd3'; diff --git a/src/test/regress/sql/password.sql b/src/test/regress/sql/password.sql index 1e7e19eafa..98f49916e5 100644 --- a/src/test/regress/sql/password.sql +++ b/src/test/regress/sql/password.sql @@ -4,14 +4,13 @@ -- Tests for GUC password_encryption SET password_encryption = 'novalue'; -- error -SET password_encryption = true; -- ok +SET password_encryption = true; -- error SET password_encryption = 'md5'; -- ok SET password_encryption = 'scram-sha-256'; -- ok -- consistency of password entries SET password_encryption = 'md5'; CREATE ROLE regress_passwd1 PASSWORD 'role_pwd1'; -SET password_encryption = 'on'; CREATE ROLE regress_passwd2 PASSWORD 'role_pwd2'; SET password_encryption = 'scram-sha-256'; CREATE ROLE regress_passwd3 PASSWORD 'role_pwd3';