From: Joe Conway <mail@joeconway.com>
To: Jodi Kanter <jkanter@virginia.edu>
Cc: Postgres Admin List <pgsql-admin@postgresql.org>
Subject: Re: password encryption
Date: Thu, 03 Oct 2002 08:48:23 -0700
Message-ID: <3D9C66C7.4070102@joeconway.com> (raw)
References: <00da01c26af1$48cd4570$de138f80@virginia.edu>
Jodi Kanter wrote:
> We are currently using the pg_passwd utility to encrypt passwords.
> Someone here told me that I can now encrypt passwords within postgresql
> so that they are not stored in plain text in the pg_shadow file.
> Is this true? I cannot seem to find any mention of it in my postgresql
> books but it's quite possible that they were all written prior to the
> release of 7.2.
See http://www.postgresql.org/idocs/index.php?runtime-config.html , a bit more
than half way down:
"PASSWORD_ENCRYPTION (boolean)
When a password is specified in CREATE USER or ALTER USER without writing
either ENCRYPTED or UNENCRYPTED, this flag determines whether the password is
to be encrypted. The default is off (do not encrypt the password), but this
choice may change in a future release. "
You can change this in postgresql.conf. Note that ENCRYPTED is the default as
of 7.3.
Also see ALTER USER:
http://www.postgresql.org/idocs/index.php?sql-alteruser.html
And pg_hba.conf:
http://www.postgresql.org/idocs/index.php?client-authentication.html#PG-HBA-CONF
Look for md5.
The basic idea is that ENCRYPTED vs UNENCRYPTED default is controlled by
PASSWORD_ENCRYPTION in the postgresql.conf file.
ALTER USER can explicitly set a user's password as ENCRYPTED.
You need to modify pg_hba.conf to allow "md5" instead of "password"
HTH,
Joe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: mail@joeconway.com, jkanter@virginia.edu
Subject: Re: password encryption
In-Reply-To: <3D9C66C7.4070102@joeconway.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox