Subject: Re: Upgrading password encryption from md5 to scram-sh-256
To: pgsql-admin@lists.postgresql.org
References: 
 <CAFpL5VytCu6h4n1hnaRS1BYTNW8uv5jx_FDERwssL_vCNYAfzw@mail.gmail.com>
 <EB91618C-D0EF-4653-A64F-1DD231F54E2D@excoventures.com>
 <CAFpL5Vwv06hv-QKB51_OLn3JYevp4dwfJQVaXk-NRame-c7+Cg@mail.gmail.com>
From: Holger Jakobs <holger@jakobs.com>
Message-ID: <8eb90d2f-2a3f-8da8-a03e-124105156678@jakobs.com>
Date: Sat, 29 May 2021 10:10:05 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.10.2
MIME-Version: 1.0
In-Reply-To: 
 <CAFpL5Vwv06hv-QKB51_OLn3JYevp4dwfJQVaXk-NRame-c7+Cg@mail.gmail.com>
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="k8uCeR23EuwcuYuNsr4OUNZtMjgJKi4lu"
Archived-At: 
 <https://www.postgresql.org/message-id/8eb90d2f-2a3f-8da8-a03e-124105156678%40jakobs.com>
Precedence: bulk

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--k8uCeR23EuwcuYuNsr4OUNZtMjgJKi4lu
Content-Type: multipart/mixed; boundary="WrSbhqmM3ymFfbZG62da47qKNtId5qjN9";
 protected-headers="v1"
From: Holger Jakobs <holger@jakobs.com>
To: pgsql-admin@lists.postgresql.org
Message-ID: <8eb90d2f-2a3f-8da8-a03e-124105156678@jakobs.com>
Subject: Re: Upgrading password encryption from md5 to scram-sh-256
References: <CAFpL5VytCu6h4n1hnaRS1BYTNW8uv5jx_FDERwssL_vCNYAfzw@mail.gmail.com>
 <EB91618C-D0EF-4653-A64F-1DD231F54E2D@excoventures.com>
 <CAFpL5Vwv06hv-QKB51_OLn3JYevp4dwfJQVaXk-NRame-c7+Cg@mail.gmail.com>
In-Reply-To: <CAFpL5Vwv06hv-QKB51_OLn3JYevp4dwfJQVaXk-NRame-c7+Cg@mail.gmail.com>

--WrSbhqmM3ymFfbZG62da47qKNtId5qjN9
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: quoted-printable
Content-Language: de-DE


Am 28.05.21 um 18:31 schrieb Nikhil Shetty:
> Hi,
>
> Thank you for your feedback Jonathan, Laurenz and Holger. I am=20
> thinking of using the below approach which will give users more=20
> control of when to change "application-user" password.
>
> Is there any drawback if the user uses below steps to change their=20
> password?
>
> 1. alter user set password_encryption to 'scram-sha-256' =C2=A02. In a =
new=20
> session, users can change their=C2=A0passwords
>
> Finally, once all users have changed password, set password_encryption =

> at instance level, make changes in pg_hba and reload.
>
> To use the same password as before, we can do "alter user <username>=20
> password <oldpassword>", so this will change to scram-sha-256 but no=20
> changes in application code.
>
> Thanks and Regards,
> Nikhil
>
Yes, that's exactly the way to go.


--=20
Holger Jakobs, Bergisch Gladbach, Tel. +49-178-9759012


--WrSbhqmM3ymFfbZG62da47qKNtId5qjN9--

--k8uCeR23EuwcuYuNsr4OUNZtMjgJKi4lu
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature"

-----BEGIN PGP SIGNATURE-----

wmMEABEIACMWIQScuJCxWJK1p5BOebGKV5yTsxlhugUCYLH23gUDAAAAAAAKCRCKV5yTsxlhujWW
AJwLyxAAN2EyvTtKh9FFcm7V65XEoACfbJitBPJXJkoe1lEb/sH9jbuzA20=
=fpmP
-----END PGP SIGNATURE-----

--k8uCeR23EuwcuYuNsr4OUNZtMjgJKi4lu--