pg.ddx.io pgsql-docs@postgresql.org mailing list archive
help / color / mirror / Atom feedPassword encryption
3+ messages / 3 participants
[nested] [flat]
* Password encryption
@ 2017-06-29 12:23 mudit0201@gmail.com
0 siblings, 1 reply; 3+ messages in thread
From: mudit0201@gmail.com @ 2017-06-29 12:23 UTC (permalink / raw)
To: pgsql-docs
The following documentation comment has been logged on the website:
Page: https://www.postgresql.org/docs/9.1/static/libpq-pgpass.html
Description:
Can we keep encrypted password in .pgpass file or is there any way to
provide encrypted password to connect to postgres or can we pass password to
psql command as an argument?
--
Sent via pgsql-docs mailing list (pgsql-docs@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-docs
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: Password encryption
@ 2017-06-29 22:38 Michael Paquier <michael.paquier@gmail.com>
parent: mudit0201@gmail.com
0 siblings, 1 reply; 3+ messages in thread
From: Michael Paquier @ 2017-06-29 22:38 UTC (permalink / raw)
To: mudit0201@gmail.com; +Cc: pgsql-docs
Hi,
On Thu, Jun 29, 2017 at 9:23 PM, <mudit0201@gmail.com> wrote:
> The following documentation comment has been logged on the website:
>
> Page: https://www.postgresql.org/docs/9.1/static/libpq-pgpass.html
> Description:
>
> Can we keep encrypted password in .pgpass file or is there any way to
> provide encrypted password to connect to postgres or can we pass password to
> psql command as an argument?
This question would be more adapted to pgsql-general, as this is not a
documentation bug.
The password present in the password file needs to be in plain format.
When using a SSL connection, the handshake happens before the actual
password authentication, so the data related to the password exchanged
would be encrypted, and in the case of MD5 what is actually sent to a
server is already a MD5 hash of it that the server compares with a
salt applied on it.
A user knowing only the MD5 hash, and not the plain password would
still be able to connect, so you really had better use SSL anyway if
connecting with an untrusted network. Postgres 10 comes up with
SCRAM-SHA-256 by the way, which is stronger by design for such things.
--
Michael
--
Sent via pgsql-docs mailing list (pgsql-docs@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-docs
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: Password encryption
@ 2018-07-13 12:20 pinker <pinker@onet.eu>
parent: Michael Paquier <michael.paquier@gmail.com>
0 siblings, 0 replies; 3+ messages in thread
From: pinker @ 2018-07-13 12:20 UTC (permalink / raw)
To: pgsql-docs
Michael Paquier wrote
>
> A user knowing only the MD5 hash, and not the plain password would
> still be able to connect, so you really had better use SSL anyway if
> connecting with an untrusted network. Postgres 10 comes up with
> SCRAM-SHA-256 by the way, which is stronger by design for such things.
Hi, with untrusted network you mean eavesdropping or some other "evil"
technique?
With normal client like psql or pgAdmin is no way to log in having only md5
hash, right?
--
Sent from: http://www.postgresql-archive.org/PostgreSQL-docs-f2165602.html
^ permalink raw reply [nested|flat] 3+ messages in thread
end of thread, other threads:[~2018-07-13 12:20 UTC | newest]
Thread overview: 3+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2017-06-29 12:23 Password encryption mudit0201@gmail.com
2017-06-29 22:38 ` Michael Paquier <michael.paquier@gmail.com>
2018-07-13 12:20 ` pinker <pinker@onet.eu>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox