pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedpassword encryption
14+ messages / 12 participants
[nested] [flat]
* password encryption
@ 2000-07-21 17:19 Silesky Marketing Inc, Support <support@silesky.com>
0 siblings, 0 replies; 14+ messages in thread
From: Silesky Marketing Inc, Support @ 2000-07-21 17:19 UTC (permalink / raw)
To: pgsql-admin
Hello,
I want to encrypt passwords with Postgresql the way mySQL does it with :
UPDATE user SET Password=PASSWORD('new_password') WHERE user='root';
How can I do that ?
Thanks a lot,
Laurent
^ permalink raw reply [nested|flat] 14+ messages in thread
* password encryption
@ 2002-08-20 09:58 Stefan Fiel <fstefan@cable.vol.at>
0 siblings, 1 reply; 14+ messages in thread
From: Stefan Fiel @ 2002-08-20 09:58 UTC (permalink / raw)
To: pgsql-admin
hi
i like to store passwords for a webapplication in my postgre database.
now i'm searching for a way to encrypt the passwords, something like the
function password() for mysql.
Does anyone know if there exists something for postgre ? if not, has anyone
another idea how i can store the password ?
thanks
STEFAN
^ permalink raw reply [nested|flat] 14+ messages in thread
* Re: password encryption
@ 2002-08-21 21:36 Tim Ellis <Tim.Ellis@gamet.com>
parent: Stefan Fiel <fstefan@cable.vol.at>
0 siblings, 2 replies; 14+ messages in thread
From: Tim Ellis @ 2002-08-21 21:36 UTC (permalink / raw)
To: Stefan Fiel <fstefan@cable.vol.at>; +Cc: pgsql-admin
> i like to store passwords for a webapplication in my postgre database.
>
> now i'm searching for a way to encrypt the passwords, something like the
> function password() for mysql.
I always run my passwords through md5sum(), which is an open source
implementation, and thus seems to've been written in every language out
there.
--
Tim Ellis
Senior Database Architect
Gamet, Inc.
^ permalink raw reply [nested|flat] 14+ messages in thread
* Re: password encryption
@ 2002-08-22 00:55 Klaus Sonnenleiter <klaus@sonnenleiter.com>
parent: Tim Ellis <Tim.Ellis@gamet.com>
1 sibling, 2 replies; 14+ messages in thread
From: Klaus Sonnenleiter @ 2002-08-22 00:55 UTC (permalink / raw)
To: Tim Ellis <Tim.Ellis@gamet.com>; Stefan Fiel <fstefan@cable.vol.at>; +Cc: pgsql-admin
To protect your passwords effectively, you probably want them encrypted before
they go on the wire, so you will need to put the encryption capability in the
application, not in the database. This way you will only transmit and store
encrypted data. Take a look at cryptix.org for some pretty good Java and Perl
implementations.
On Wednesday 21 August 2002 05:36, Tim Ellis wrote:
> > i like to store passwords for a webapplication in my postgre database.
> >
> > now i'm searching for a way to encrypt the passwords, something like the
> > function password() for mysql.
>
> I always run my passwords through md5sum(), which is an open source
> implementation, and thus seems to've been written in every language out
> there.
^ permalink raw reply [nested|flat] 14+ messages in thread
* Re: password encryption
@ 2002-08-22 01:40 David F. Skoll <dfs@roaringpenguin.com>
parent: Tim Ellis <Tim.Ellis@gamet.com>
1 sibling, 0 replies; 14+ messages in thread
From: David F. Skoll @ 2002-08-22 01:40 UTC (permalink / raw)
To: Tim Ellis <Tim.Ellis@gamet.com>; +Cc: Stefan Fiel <fstefan@cable.vol.at>; pgsql-admin
On Wed, 21 Aug 2002, Tim Ellis wrote:
> I always run my passwords through md5sum(), which is an open source
> implementation, and thus seems to've been written in every language out
> there.
But a straight md5sum leaves you open to a dictionary attack. You want
to add some salt by doing something like this:
salt = random_4_char_string;
encrypted_password = salt + md5sum(salt + cleartext_password);
To verify, just extract the salt from the encrypted password and redo the
calculation.
A dictionary attack is now much less feasible because the same cleartext
password can encrypt to millions of different ciphertext passwords.
--
David.
^ permalink raw reply [nested|flat] 14+ messages in thread
* Re: password encryption
@ 2002-08-22 02:11 Bruce Momjian <pgman@candle.pha.pa.us>
parent: Klaus Sonnenleiter <klaus@sonnenleiter.com>
1 sibling, 0 replies; 14+ messages in thread
From: Bruce Momjian @ 2002-08-22 02:11 UTC (permalink / raw)
To: Klaus Sonnenleiter <klaus@sonnenleiter.com>; +Cc: Tim Ellis <Tim.Ellis@gamet.com>; Stefan Fiel <fstefan@cable.vol.at>; pgsql-admin
See contrib/pg_crypto for encryption routines you can load into the
database.
---------------------------------------------------------------------------
Klaus Sonnenleiter wrote:
> To protect your passwords effectively, you probably want them encrypted before
> they go on the wire, so you will need to put the encryption capability in the
> application, not in the database. This way you will only transmit and store
> encrypted data. Take a look at cryptix.org for some pretty good Java and Perl
> implementations.
>
> On Wednesday 21 August 2002 05:36, Tim Ellis wrote:
> > > i like to store passwords for a webapplication in my postgre database.
> > >
> > > now i'm searching for a way to encrypt the passwords, something like the
> > > function password() for mysql.
> >
> > I always run my passwords through md5sum(), which is an open source
> > implementation, and thus seems to've been written in every language out
> > there.
>
> ---------------------------(end of broadcast)---------------------------
> TIP 2: you can get off all lists at once with the unregister command
> (send "unregister YourEmailAddressHere" to majordomo@postgresql.org)
>
--
Bruce Momjian | http://candle.pha.pa.us
pgman@candle.pha.pa.us | (610) 359-1001
+ If your life is a hard drive, | 13 Roberts Road
+ Christ can be your backup. | Newtown Square, Pennsylvania 19073
^ permalink raw reply [nested|flat] 14+ messages in thread
* Re: password encryption
@ 2002-08-22 02:12 Bruce Momjian <pgman@candle.pha.pa.us>
parent: Klaus Sonnenleiter <klaus@sonnenleiter.com>
1 sibling, 0 replies; 14+ messages in thread
From: Bruce Momjian @ 2002-08-22 02:12 UTC (permalink / raw)
To: Klaus Sonnenleiter <klaus@sonnenleiter.com>; +Cc: Tim Ellis <Tim.Ellis@gamet.com>; Stefan Fiel <fstefan@cable.vol.at>; pgsql-admin
Never mind what I just said. I see the issue of encrypting before being
sent over the wire. We do that for PostgreSQL password, but if you want
to do it for a value before it is sent over the wire, you can use an SSL
connection to the database, or some client-side encryption.
---------------------------------------------------------------------------
Klaus Sonnenleiter wrote:
> To protect your passwords effectively, you probably want them encrypted before
> they go on the wire, so you will need to put the encryption capability in the
> application, not in the database. This way you will only transmit and store
> encrypted data. Take a look at cryptix.org for some pretty good Java and Perl
> implementations.
>
> On Wednesday 21 August 2002 05:36, Tim Ellis wrote:
> > > i like to store passwords for a webapplication in my postgre database.
> > >
> > > now i'm searching for a way to encrypt the passwords, something like the
> > > function password() for mysql.
> >
> > I always run my passwords through md5sum(), which is an open source
> > implementation, and thus seems to've been written in every language out
> > there.
>
> ---------------------------(end of broadcast)---------------------------
> TIP 2: you can get off all lists at once with the unregister command
> (send "unregister YourEmailAddressHere" to majordomo@postgresql.org)
>
--
Bruce Momjian | http://candle.pha.pa.us
pgman@candle.pha.pa.us | (610) 359-1001
+ If your life is a hard drive, | 13 Roberts Road
+ Christ can be your backup. | Newtown Square, Pennsylvania 19073
^ permalink raw reply [nested|flat] 14+ messages in thread
* password encryption
@ 2002-10-03 15:26 Jodi Kanter <jkanter@virginia.edu>
0 siblings, 1 reply; 14+ messages in thread
From: Jodi Kanter @ 2002-10-03 15:26 UTC (permalink / raw)
To: pgsql-admin
We are currently using the pg_passwd utility to encrypt passwords. Someone here told me that I can now encrypt passwords within postgresql so that they are not stored in plain text in the pg_shadow file.
Is this true? I cannot seem to find any mention of it in my postgresql books but it's quite possible that they were all written prior to the release of 7.2.
Thanks
Jodi
_______________________________
Jodi L Kanter
BioInformatics Database Administrator
University of Virginia
(434) 924-2846
jkanter@virginia.edu
^ permalink raw reply [nested|flat] 14+ messages in thread
* Re: password encryption
@ 2002-10-03 15:48 Joe Conway <mail@joeconway.com>
parent: Jodi Kanter <jkanter@virginia.edu>
0 siblings, 0 replies; 14+ messages in thread
From: Joe Conway @ 2002-10-03 15:48 UTC (permalink / raw)
To: Jodi Kanter <jkanter@virginia.edu>; +Cc: pgsql-admin
Jodi Kanter wrote:
> We are currently using the pg_passwd utility to encrypt passwords.
> Someone here told me that I can now encrypt passwords within postgresql
> so that they are not stored in plain text in the pg_shadow file.
> Is this true? I cannot seem to find any mention of it in my postgresql
> books but it's quite possible that they were all written prior to the
> release of 7.2.
See http://www.postgresql.org/idocs/index.php?runtime-config.html , a bit more
than half way down:
"PASSWORD_ENCRYPTION (boolean)
When a password is specified in CREATE USER or ALTER USER without writing
either ENCRYPTED or UNENCRYPTED, this flag determines whether the password is
to be encrypted. The default is off (do not encrypt the password), but this
choice may change in a future release. "
You can change this in postgresql.conf. Note that ENCRYPTED is the default as
of 7.3.
Also see ALTER USER:
http://www.postgresql.org/idocs/index.php?sql-alteruser.html
And pg_hba.conf:
http://www.postgresql.org/idocs/index.php?client-authentication.html#PG-HBA-CONF
Look for md5.
The basic idea is that ENCRYPTED vs UNENCRYPTED default is controlled by
PASSWORD_ENCRYPTION in the postgresql.conf file.
ALTER USER can explicitly set a user's password as ENCRYPTED.
You need to modify pg_hba.conf to allow "md5" instead of "password"
HTH,
Joe
^ permalink raw reply [nested|flat] 14+ messages in thread
* Password Encryption
@ 2003-01-22 14:27 Raúl Gutiérrez Sánchez <raul@laeff.esa.es>
0 siblings, 1 reply; 14+ messages in thread
From: Raúl Gutiérrez Sánchez @ 2003-01-22 14:27 UTC (permalink / raw)
To: pgsql-admin
I have tried to perform a cryp authentication but it seems not to work
if the user passwords are stored md5-encrypted in the database. Is this
behaviour normal?.
Regards,
Raul Gutierrez
^ permalink raw reply [nested|flat] 14+ messages in thread
* Re: Password Encryption
@ 2003-01-26 23:51 Bruce Momjian <pgman@candle.pha.pa.us>
parent: Raúl Gutiérrez Sánchez <raul@laeff.esa.es>
0 siblings, 0 replies; 14+ messages in thread
From: Bruce Momjian @ 2003-01-26 23:51 UTC (permalink / raw)
To: Raúl Gutiérrez Sánchez <raul@laeff.esa.es>; +Cc: pgsql-admin
Yes, it is. We now recommend MD5, and have since 7.2. The only way to
use crypt still is to store the password UNENCRYPTED in ALTER USER.
---------------------------------------------------------------------------
Raúl Gutiérrez Sánchez wrote:
> I have tried to perform a cryp authentication but it seems not to work
> if the user passwords are stored md5-encrypted in the database. Is this
> behaviour normal?.
>
> Regards,
> Raul Gutierrez
>
> ---------------------------(end of broadcast)---------------------------
> TIP 2: you can get off all lists at once with the unregister command
> (send "unregister YourEmailAddressHere" to majordomo@postgresql.org)
>
--
Bruce Momjian | http://candle.pha.pa.us
pgman@candle.pha.pa.us | (610) 359-1001
+ If your life is a hard drive, | 13 Roberts Road
+ Christ can be your backup. | Newtown Square, Pennsylvania 19073
^ permalink raw reply [nested|flat] 14+ messages in thread
* Password encryption
@ 2018-04-16 00:22 Azimuddin Mohammed <azimeiu@gmail.com>
0 siblings, 2 replies; 14+ messages in thread
From: Azimuddin Mohammed @ 2018-04-16 00:22 UTC (permalink / raw)
To: pgsql-admin; Postgres General <pgsql-general@postgresql.org>
Hello,
Is there a way I can encrypt the default password column of db user
password. I know by default the password is encrypted as md5, can we
encrypt that of shadow column for password?
Thanks in advance
^ permalink raw reply [nested|flat] 14+ messages in thread
* Re: Password encryption
@ 2018-04-16 00:37 Adrian Klaver <adrian.klaver@aklaver.com>
parent: Azimuddin Mohammed <azimeiu@gmail.com>
1 sibling, 0 replies; 14+ messages in thread
From: Adrian Klaver @ 2018-04-16 00:37 UTC (permalink / raw)
To: Azimuddin Mohammed <azimeiu@gmail.com>; pgsql-admin; Postgres General <pgsql-general@postgresql.org>
On 04/15/2018 05:22 PM, Azimuddin Mohammed wrote:
> Hello,
> Is there a way I can encrypt the default password column of db user
> password. I know by default the password is encrypted as md5, can we
> encrypt that of shadow column for password?
Are you talking about this view?:
https://www.postgresql.org/docs/10/static/view-pg-shadow.html
If so that is only readable by superusers:
production=# \c - aklaver
You are now connected to database "production" as user "aklaver".
production=> select * from pg_shadow ;
ERROR: permission denied for relation pg_shadow
production=> \c - postgres
You are now connected to database "production" as user "postgres".
production=# select * from pg_shadow ;
usename | usesysid | usecreatedb | usesuper | userepl |
usebypassrls | passwd | valuntil | useconfig
...
Assuming someone is in your database as a superuser, access to the
password field in pg_shadow is pretty much moot.
>
> Thanks in advance
--
Adrian Klaver
adrian.klaver@aklaver.com
^ permalink raw reply [nested|flat] 14+ messages in thread
* Re: Password encryption
@ 2018-04-16 01:16 Ron <ronljohnsonjr@gmail.com>
parent: Azimuddin Mohammed <azimeiu@gmail.com>
1 sibling, 0 replies; 14+ messages in thread
From: Ron @ 2018-04-16 01:16 UTC (permalink / raw)
To: pgsql-admin@lists.postgresql.org
On 04/15/2018 07:22 PM, Azimuddin Mohammed wrote:
> Hello,
> Is there a way I can encrypt the default password column of db user
> password. I know by default the password is encrypted as md5, can we
> encrypt that of shadow column for password?
MD5 is a *one-way hash*, not an encryption scheme. Thus, the password
cannot be reverse-computed from the MD5 hash value. So, you're (kinda)
safe, although an attacker could determine the password through brute-force
calculation of hashes.
--
Angular momentum makes the world go 'round.
^ permalink raw reply [nested|flat] 14+ messages in thread
end of thread, other threads:[~2018-04-16 01:16 UTC | newest]
Thread overview: 14+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2000-07-21 17:19 password encryption Silesky Marketing Inc, Support <support@silesky.com>
2002-08-20 09:58 password encryption Stefan Fiel <fstefan@cable.vol.at>
2002-08-21 21:36 ` Tim Ellis <Tim.Ellis@gamet.com>
2002-08-22 00:55 ` Klaus Sonnenleiter <klaus@sonnenleiter.com>
2002-08-22 02:11 ` Bruce Momjian <pgman@candle.pha.pa.us>
2002-08-22 02:12 ` Bruce Momjian <pgman@candle.pha.pa.us>
2002-08-22 01:40 ` David F. Skoll <dfs@roaringpenguin.com>
2002-10-03 15:26 password encryption Jodi Kanter <jkanter@virginia.edu>
2002-10-03 15:48 ` Joe Conway <mail@joeconway.com>
2003-01-22 14:27 Password Encryption Raúl Gutiérrez Sánchez <raul@laeff.esa.es>
2003-01-26 23:51 ` Re: Password Encryption Bruce Momjian <pgman@candle.pha.pa.us>
2018-04-16 00:22 Password encryption Azimuddin Mohammed <azimeiu@gmail.com>
2018-04-16 00:37 ` Re: Password encryption Adrian Klaver <adrian.klaver@aklaver.com>
2018-04-16 01:16 ` Re: Password encryption Ron <ronljohnsonjr@gmail.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox