Date: Wed, 24 Apr 2019 08:12:16 +0900
From: Michael Paquier <michael@paquier.xyz>
To: "Jonathan S. Katz" <jkatz@postgresql.org>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, pgsql-bugs@lists.postgresql.org,
	Stephen Frost <sfrost@snowman.net>
Subject: Re: Possible to store invalid SCRAM-SHA-256 Passwords
Message-ID: <20190423231216.GA1878@paquier.xyz>
References: <3033.1555940554@sss.pgh.pa.us>
 <5a93333c-dde6-ee52-f870-4dccfc50eb6f@postgresql.org>
 <30284.1555972921@sss.pgh.pa.us>
 <15140775-08c3-45bd-6dab-fdcd290d1bf0@postgresql.org>
 <20190423010142.GE2712@paquier.xyz>
 <10698.1555981849@sss.pgh.pa.us>
 <265876b8-1a72-89cd-bdcf-e641d93e166c@postgresql.org>
 <20190423021018.GF2712@paquier.xyz>
 <20190423065701.GL2712@paquier.xyz>
 <43882bd7-a002-dd50-bf9a-401560285485@postgresql.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="PEIAKu/WMn1b1Hv9"
Content-Disposition: inline
In-Reply-To: <43882bd7-a002-dd50-bf9a-401560285485@postgresql.org>
Precedence: bulk


--PEIAKu/WMn1b1Hv9
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, Apr 23, 2019 at 10:19:30AM -0400, Jonathan S. Katz wrote:
> - If you have an invalid SCRAM-SHA-256 password (e.g.
> SCRAM-SHA-256$1234), you would have been unable to log in anyway, so in
> all likelihood you would either have had an admin reset your password,
> or you gave up.
> - If you had a md5 hash with bogus characters in it, it'd be the above
> as well
>=20
> So likely it's been resolved in some way: the user has been issued a new
> password or has given up on PostgreSQL
>=20
> With that said, we could do something like:
>=20
> "To determine if this release affects an of your users ability to log in
> using either the SCRAM-SHA-256 on MD5 password based methods, you can
> run the following query:

s/an of/any of/.

> We advise that you reset the passwords for these users.

Sounds fine to me, thanks.  I am not sure if we would want to have
something in the release notes, on a wiki page with the release notes
including a link to it, or just no direct mention in the release
notes.  In the past, say for the issue with the incorrect VM page
references, we have been a wiki page with queries and such for
diagnostics.

> +1 for fixing so its consistent (at least from a behavior standpoint).
>=20
> I confirmed that it's in 9.5 & 9.4 as well.

Thanks for confirming, I am going to patch 9.4~9.6 with that.
--
Michael

--PEIAKu/WMn1b1Hv9
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAly/m9AACgkQnvQgOdby
QH1ppg//c+u+iHO6I/X0n5fS67XHhqzx30K/3Ye14VODYX23PgPYY/hjfYyHUqKe
uVGk3M/0XpNkLHXoNmI/9iqiPoE4SOHIN67Z4NtKJ/bG+dONx18GbZUflLQCSHCw
jzyMU/BIiGhX1drDX+NIF2gkXQGJ+tDi0lsxOGFRPuzn4MiiwK0IaBLOgWoqEGWO
PXBx4kXWivb3pqUBQu8h0FXuGL3zKbE8T1C7zF1tXxEGzVJBMhDFmiYiHj8hlKKU
F3AunrMC75klqFBvjSZMYYi/9fgtdGIq3eI+9pfNpLZ8jRqVN17K1tanb+wBQD+v
LVasbXKsHoCgSZgoGLXem4YwaPa18/zxDBmNr5kXf9YkMbf6kgwYxf2+NmElKxCc
NlDl4fvQTwp0L32XoqlLPA2C1xQO2E+gcQ8nT3Q/KIHxyeGp7v3UpM7lsHz3nBUY
AMCNBNAP7IjHXFEVaZQ/rhKMJdLf6QY5o9fjr2i9wHkxqjyC7rJj6ddb1EArawUM
veK5yxh5ffo/0Y9EmUD0ePkkcMG4zvgEFZCBqll97L7l7/HbelAr9G4OmqvTZIW6
b++gEOeaOc2+CYNu9RIIaLx+3yyl124A0GcyCWzP/c0r8Yvtkk1YR5O5IZVmmKsJ
7Gkn/UxgZswnMOIogeVM3qHYg9OtN1nYw0ptA3HXV672jwJG/F8=
=vPNW
-----END PGP SIGNATURE-----

--PEIAKu/WMn1b1Hv9--