From: Michael Paquier <michael@paquier.xyz>
To: Jonathan S. Katz <jkatz@postgresql.org>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: pgsql-bugs@lists.postgresql.org, Stephen Frost <sfrost@snowman.net>
Subject: Re: Possible to store invalid SCRAM-SHA-256 Passwords
Date: Wed, 24 Apr 2019 08:12:16 +0900
Message-ID: <20190423231216.GA1878@paquier.xyz> (raw)
In-Reply-To: <43882bd7-a002-dd50-bf9a-401560285485@postgresql.org>
References: <3033.1555940554@sss.pgh.pa.us>
<5a93333c-dde6-ee52-f870-4dccfc50eb6f@postgresql.org>
<30284.1555972921@sss.pgh.pa.us>
<15140775-08c3-45bd-6dab-fdcd290d1bf0@postgresql.org>
<20190423010142.GE2712@paquier.xyz>
<10698.1555981849@sss.pgh.pa.us>
<265876b8-1a72-89cd-bdcf-e641d93e166c@postgresql.org>
<20190423021018.GF2712@paquier.xyz>
<20190423065701.GL2712@paquier.xyz>
<43882bd7-a002-dd50-bf9a-401560285485@postgresql.org>
On Tue, Apr 23, 2019 at 10:19:30AM -0400, Jonathan S. Katz wrote:
> - If you have an invalid SCRAM-SHA-256 password (e.g.
> SCRAM-SHA-256$1234), you would have been unable to log in anyway, so in
> all likelihood you would either have had an admin reset your password,
> or you gave up.
> - If you had a md5 hash with bogus characters in it, it'd be the above
> as well
>
> So likely it's been resolved in some way: the user has been issued a new
> password or has given up on PostgreSQL
>
> With that said, we could do something like:
>
> "To determine if this release affects an of your users ability to log in
> using either the SCRAM-SHA-256 on MD5 password based methods, you can
> run the following query:
s/an of/any of/.
> We advise that you reset the passwords for these users.
Sounds fine to me, thanks. I am not sure if we would want to have
something in the release notes, on a wiki page with the release notes
including a link to it, or just no direct mention in the release
notes. In the past, say for the issue with the incorrect VM page
references, we have been a wiki page with queries and such for
diagnostics.
> +1 for fixing so its consistent (at least from a behavior standpoint).
>
> I confirmed that it's in 9.5 & 9.4 as well.
Thanks for confirming, I am going to patch 9.4~9.6 with that.
--
Michael
Attachments:
[application/pgp-signature] signature.asc (832B, ../20190423231216.GA1878@paquier.xyz/2-signature.asc)
download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: michael@paquier.xyz, jkatz@postgresql.org, tgl@sss.pgh.pa.us, sfrost@snowman.net
Subject: Re: Possible to store invalid SCRAM-SHA-256 Passwords
In-Reply-To: <20190423231216.GA1878@paquier.xyz>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox