From: Adrian Klaver <adrian.klaver@aklaver.com>
To: Pavan Kumar <pavan.dba27@gmail.com>
To: David G. Johnston <david.g.johnston@gmail.com>
Cc: Pgsql-admin <pgsql-admin@lists.postgresql.org>
Cc: pgsql-generallists.postgresql.org <pgsql-general@lists.postgresql.org>
Subject: Re: scram-sha-256 encrypted password in pgpass
Date: Mon, 22 Jun 2020 15:36:18 -0700
Message-ID: <582060cb-79b9-1091-e464-dd8ee45c8624@aklaver.com> (raw)
In-Reply-To: <CA+M0sHE=wMp3Q251AaHcz612D14qY7X3xgGvzuM8npAY_B6FxA@mail.gmail.com>
References: <CA+M0sHEJC6whG8VfNk=393uoDsedQg+tVZ9vy7GLdWBZR5BC0A@mail.gmail.com>
<CAKFQuwZHLq1o55-sSaeuF8hU=9nYXN8MNTdL50A7W7Zf_6ZjHQ@mail.gmail.com>
<CA+M0sHE=wMp3Q251AaHcz612D14qY7X3xgGvzuM8npAY_B6FxA@mail.gmail.com>
On 6/22/20 3:32 PM, Pavan Kumar wrote:
> Adrian, David,
>
> Thank you so much for the quick response.
>
> What would be the point of storing the encrypted password instead of the
> plaintext one?
> As per our organization security policies, we can 't keep any passwords
> in plain text format.
But if you want to log in with encrypted password and someone can grab
it from the file not sure what the difference is from grabbing the plain
text one if they both end up logging the user in?
> I am working on postgres + pgbouncer setup, tested pgbouncer 1.14 where
> we have support to use encrypted password in userlist,txt file. I am
> surprised why pgpass is not supporting encrypted passwords.
>
>
>
>
> On Mon, Jun 22, 2020 at 5:04 PM David G. Johnston
> <david.g.johnston@gmail.com <mailto:david.g.johnston@gmail.com>> wrote:
>
> Please don't cross-post.
>
> On Mon, Jun 22, 2020 at 1:35 PM Pavan Kumar <pavan.dba27@gmail.com
> <mailto:pavan.dba27@gmail.com>> wrote:
>
> scram-sha-256 encrypted passwords are supported in .pgpass file
> ? If yes kindly provide us an example.
>
> I am using below format and it is not working for me
>
> /|pglnx1|/:/|5432|/:pgbouncer:/|pgadmin|/:"SCRAM-SHA-256$4096:6IDsjfedwsdpymp0Za7jaMew==$rzSoYL4ZYsW1WJAj7Lt3JtNLNR73AVY7sfsauikweblk][=:Hxx/juPXJZHy5djPctI=*/"/*
>
> The documentation doesn't say so one way or the other so I would go
> with no. The password in the pgpass file has to be the plaintext
> password. The client, upon speaking with the server, will decide
> whether to send the plaintext password to the server or encrypt it
> prior to transmission.
>
> What would be the point of storing the encrypted password instead of
> the plaintext one?
>
> David J.
>
>
>
> --
> *Regards,
>
> #! Pavan Kumar
> ----------------------------------------------*-
> *Sr. Database Administrator..!*
> *NEXT GENERATION PROFESSIONALS, LLC*
> *Cell # 267-799-3182 # pavan.dba27 (Gtalk) *
> *India # 9000459083*
>
> *Take Risks; if you win, you will be very happy. If you lose you
> will be Wise *
>
--
Adrian Klaver
adrian.klaver@aklaver.com
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: adrian.klaver@aklaver.com, pavan.dba27@gmail.com, david.g.johnston@gmail.com, pgsql-admin@lists.postgresql.org, pgsql-general@lists.postgresql.org
Subject: Re: scram-sha-256 encrypted password in pgpass
In-Reply-To: <582060cb-79b9-1091-e464-dd8ee45c8624@aklaver.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox