Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtps
 (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <pgsql-admin-owner+archive@lists.postgresql.org>)
	id 1lmdg1-0005uM-R4
	for pgsql-admin@arkaria.postgresql.org; Fri, 28 May 2021 14:41:29 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.92)
	(envelope-from <pgsql-admin-owner+archive@lists.postgresql.org>)
	id 1lmdg0-0000bM-PL
	for pgsql-admin@arkaria.postgresql.org; Fri, 28 May 2021 14:41:28 +0000
Received: from makus.postgresql.org ([2001:4800:3e1:1::229])
	by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <holger@jakobs.com>)
	id 1lmdg0-0000bE-Go
	for pgsql-admin@lists.postgresql.org; Fri, 28 May 2021 14:41:28 +0000
Received: from jakobs.com ([85.214.83.89] helo=rs.plausibolo.de)
	by makus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <holger@jakobs.com>)
	id 1lmdfy-0005uO-ES
	for pgsql-admin@lists.postgresql.org; Fri, 28 May 2021 14:41:27 +0000
Received: from localhost (localhost [127.0.0.1])
	by rs.plausibolo.de (Postfix) with ESMTP id 1714E380565;
	Fri, 28 May 2021 16:41:24 +0200 (CEST)
Received: from rs.plausibolo.de ([127.0.0.1])
	by localhost (h2367442.stratoserver.net [127.0.0.1]) (amavisd-new,
 port 10024)
	with ESMTP id iXAHzayWKGyd; Fri, 28 May 2021 16:41:23 +0200 (CEST)
Received: from [10.172.146.109]
 (dynamic-046-114-106-109.46.114.pool.telefonica.de [46.114.106.109])
	by rs.plausibolo.de (Postfix) with ESMTPSA id B6E1F3804F9;
	Fri, 28 May 2021 16:41:23 +0200 (CEST)
Date: Fri, 28 May 2021 16:41:21 +0200
User-Agent: K-9 Mail for Android
In-Reply-To: 
 <CAFpL5VytCu6h4n1hnaRS1BYTNW8uv5jx_FDERwssL_vCNYAfzw@mail.gmail.com>
References: 
 <CAFpL5VytCu6h4n1hnaRS1BYTNW8uv5jx_FDERwssL_vCNYAfzw@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
 boundary="----38ECHQ13XT97RX4JDAWWLXVDF7SM6N"
Content-Transfer-Encoding: 7bit
Subject: Re: Upgrading password encryption from md5 to scram-sh-256
To: pgsql-admin@lists.postgresql.org
From: Holger Jakobs <holger@jakobs.com>
Message-ID: <024F93BC-DB7C-4E00-8D46-5D7033CB0929@jakobs.com>
List-Id: <pgsql-admin.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-admin@lists.postgresql.org>
List-Owner: <mailto:pgsql-admin-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-admin>
Archived-At: 
 <https://www.postgresql.org/message-id/024F93BC-DB7C-4E00-8D46-5D7033CB0929%40jakobs.com>
Precedence: bulk

------38ECHQ13XT97RX4JDAWWLXVDF7SM6N
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable



Am 28=2E Mai 2021 15:27:43 MESZ schrieb Nikhil Shetty <nikhil=2Edba04@gmai=
l=2Ecom>:
>Hi Team,
>
>Just a quick check
>As per documentation, for upgrading password encryption from md5 to
>scram-sha-256, we have to set password_encryption to scram-sha-256,
>reset
>the user password and then change in pg_hba=2Econf=2E
>
>Is there any other way to do this without changing the password? if
>there
>are a lot of login users in the database it becomes difficult and it
>may
>incur downtime as well=2E
>
>I see there is a way the users can do it by themselves but still will
>incur some downtime=2E
>
>Thanks and Regards,
>Nikhil

It's no problem to leave the setting at md5 as this accepts the new scram =
passwords as well=2E

Just check after a while whether all passwords have been changed to scram=
=2E=20

Since there is no way of retrieving a password in clear it's also impossib=
le to change them to scram automatically=2E

Hope this helps=2E



--=20
Holger Jakobs, Bergisch Gladbach
+49 178 9759012
- sent from mobile, therefore short -

------38ECHQ13XT97RX4JDAWWLXVDF7SM6N
Content-Type: text/html;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable

<html><head></head><body><br><br><div class=3D"gmail_quote">Am 28=2E Mai 20=
21 15:27:43 MESZ schrieb Nikhil Shetty &lt;nikhil=2Edba04@gmail=2Ecom&gt;:<=
blockquote class=3D"gmail_quote" style=3D"margin: 0pt 0pt 0pt 0=2E8ex; bord=
er-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div dir=3D"ltr">Hi Team,<div><br></div><div>Just a quick&nbsp;check</div>=
<div>As per documentation, for upgrading password encryption from md5 to sc=
ram-sha-256, we have to set password_encryption to scram-sha-256, reset the=
 user password and then change in pg_hba=2Econf=2E</div><div><br></div><div=
>Is there any other way to do this without changing the password? if there =
are a lot of login users in the database it becomes difficult and it may in=
cur&nbsp;downtime as well=2E</div><div><br></div><div>I see there is a way =
the users can do it by themselves but still will incur&nbsp;some downtime=
=2E</div><div><br></div><div>Thanks and Regards,</div><div>Nikhil</div></di=
v>
</blockquote></div><br>It's no problem to leave the setting at md5 as this=
 accepts the new scram passwords as well=2E<br><br>Just check after a while=
 whether all passwords have been changed to scram=2E <br><br>Since there is=
 no way of retrieving a password in clear it's also impossible to change th=
em to scram automatically=2E<br><br>Hope this helps=2E<br><br><br><br>-- <b=
r>Holger Jakobs, Bergisch Gladbach<br>+49 178 9759012<br>- sent from mobile=
, therefore short -<br></body></html>
------38ECHQ13XT97RX4JDAWWLXVDF7SM6N--