Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hUA1D-0005OK-SC for pgsql-hackers@arkaria.postgresql.org; Fri, 24 May 2019 13:13:56 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1hUA1C-0001c4-FV for pgsql-hackers@arkaria.postgresql.org; Fri, 24 May 2019 13:13:54 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hUA1B-0001Yx-Tt for pgsql-hackers@lists.postgresql.org; Fri, 24 May 2019 13:13:54 +0000 Received: from meldrar.postgresql.org ([2a02:c0:301:0:ffff::31]) by makus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hUA19-0006AO-HQ for pgsql-hackers@postgresql.org; Fri, 24 May 2019 13:13:52 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=postgresql.org; s=20171124; h=Content-Type:In-Reply-To:MIME-Version:Date: Message-ID:From:References:Cc:To:Subject:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=stGltCnh620rActNsWcUrC0QCQfdSQ0eTYp5H/bH9t8=; b=6RYYVK0tjeeobkapn2SLaNXwyn Ol7Zjs1hTKk5Me2nWZky41JTgl2b9UdIQp0pRDH6+XjYDEodFApNp9oZLlXpi5aN897YHpyHg4lcU rhgCtkzKPAduRQGZPXqS+a3nFVJQMXjP0jJ7UQdbSlfd9K96oSQeBFC/8VVs00uzjaUIpkbRt84O7 cWA6mNdbDkfZcnXoW4Z8G6+CmgBMQjgjdggefvx3CuLYkH4eVlu10m0aD1seE6GkrnCBM4kO6JntF 26Wz2TISh3J4ku6W1wOBbB6/MqoQAP5ppWXcJnU5L/IvSJN3ULv3/OPXa3ja8LMAC8xMLdLbVbxhm 7eb4bpEQ==; Received: from pool-96-250-83-19.nycmny.fios.verizon.net ([96.250.83.19] helo=Ph33r-Retina.home) by meldrar.postgresql.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hUA13-0000CL-PJ; Fri, 24 May 2019 13:13:48 +0000 Subject: Re: initdb recommendations To: Stephen Frost Cc: Magnus Hagander , Joe Conway , Tom Lane , Peter Eisentraut , pgsql-hackers , Noah Misch References: <9f46f065-ca80-f637-8c5d-a9877bcd5eab@postgresql.org> <10093.1558664907@sss.pgh.pa.us> <20190524023009.GL2480@tamriel.snowman.net> <20190524121306.GS2480@tamriel.snowman.net> <17041a05-0e28-f2b1-bf0c-fe375af66b45@joeconway.com> <20190524121904.GU2480@tamriel.snowman.net> <20190524123317.GW2480@tamriel.snowman.net> <20190524130123.GY2480@tamriel.snowman.net> From: "Jonathan S. Katz" Openpgp: preference=signencrypt Autocrypt: addr=jkatz@postgresql.org; keydata= mQINBFtShwABEAC7PNHDUOTYuifpUCk23KqfxdQQkn4nkoxOXRK0+rAj36FiwqGB4TJFuOVZ sDFAEiSlC8Jt4y5Cs7B5tetT8JNd2cs6zp/udMJJDz9d65O9PDpdlMgAmIiTzpLlSdx8FG56 DTksaDv1d8j3cTJPSE4/fWSxqzA7o3Y9UuL7atZPrzfImgpRKs0of7elIHwOa8GucjyhYqcR h60wFBJc2KXqQdDYRTZy43DSnY/0VNc0omiH355fustvpm+m5HjD3w7qZyfN3fpKJpnX1LCF f3MnPHaDGITIYGRCBXvf0UqUtD6OEVWPv2C2gyqWMIpWmZTOgDufltKyIByKBoS9x0PlFkij 04X3KODCngt+N8Ssc9OICc6QSxhjoP48PYPdmiTmkrGuf0LX084wj1xeo1NX7XxZK39F6dTJ DhsIiW0sNS0xMxQHLHG9VLbPjx3SANQBh6BuryPz5ZupW9/TIDmkvprtU/oXfKgtfYm3fxmk EctxbWrEPsFTFPyuMqQu6l+xyQv0s1VLZfjNWaua6H1/gGoIt6kRnn5qMXDVVpijuWkHbv7G ngaQMd258UrrOEHnnjzhQ7jxMWV9D+emxbAtlIxnYvCWlV4IwAQhEHfvudqYaIY3hNWrvQ6H GB2KXoTZYN9g5djm14/5nj1IU5zOcovkjJnKhoo9iStnpFF2cwARAQABtCdKb25hdGhhbiBT LiBLYXR6IDxqa2F0ekBwb3N0Z3Jlc3FsLm9yZz6JAlQEEwEIAD4CGwMFCQeGH4AFCwkIBwIG FQoJCAsCBBYCAwECHgECF4AWIQT6hLaVryv3miBkP/HxBJxynxxlJwUCW1KJJQAKCRDxBJxy nxxlJwjrD/kBgqsW4QpNpTFw7ifRokZV08CCX4huPBJQ91rrv+UEWlEcotFBHVkYyHnpzARl tcZxhJ9CbFxjniH9cOTty5T/O1yolbOHtZSW8Z8aWV6BVEbjMb+BFxSSLm7RnvJdzQbGCZq2 ZZvfVpB6z3EHYph4KDdVKvMFjoLskxmdS1DE0tE3zTxvoQsi24Q+HOS07kUjs6fsu/WICMfz mgO++AWG9Y0CvN0mm4TkujESzyKM9E5irD+leEMIcddl51Aa2c/VMfBXQbRmpHIgUFTmuHQD CnQih+9i3OJAksDg66SP8a7yiXv5mwvyDi1EfTGVKYR2j+pwyjwnC3oIbvDMmB3uTn2JIjnT iZKPVtAcAylXjubFltihQgNyuShdP4W+kBwZizhUFqUVL8Anx+KoytYmJPfMRFLGuK4obXKq a2ZS3k9KB+H+isOx2nFJOsc7V360Zp1DVaNmuiK10TT6QndShSPaqkJqFtCb6r92rZ9sZM/L 3vtCI4Rrl3Pt1MgtENXupS8gZpJnAYS0j5A1PAZ09r6ANoaeMHspF+5J5fOHeEvqphXr36mm a83Vl1t4orPb0+QmmijmlpseDU63M88Aw5p3c4qj7t8Qr2EZ5zrn7/sFn5wOfbs8Nymxafif QCnlV2vg9p0m7vSk/yLJ4PFZvs52FgqAGRCdRn0s2EC99bkCDQRbUocAARAAv8ho/toQ9DG3 j4f9h9n1aRHr2FlviN2Utpy6L8+dfDggO0geilmkGQOolZ2E60gGfye/kUtF9W3NByO4hxDR 9u6qbOXcdqnuA+cc68EfqlWFJrVtYFxt0h4ElWYOYnIezKthriWch/FY70FGrxs3z8UHOHq5 0wBW433eTvZm90WixBiXEt2v1DgW4Vr3ymfO7Aap/IYyPuE4JzgudAuAl0HKPyNEHWHG1dAb jX1RiCw9gknIDWQOF0B4UAaJctWGVcnZ3A2ULwNGMa1P9ZJlBWf1vcj01aiHMU0yQ7JjJiSp vfm9eM0uSLwRdDrJjyl5ZZqVumjdv2SMNQ8GvYRbEMys3GGDSt9zXgfCSUnPnJfYxjzBHRI6 x44Wfsx8S6hWxepOogCJJ/g67Bk9mY8YV4klWIXDJVOL5jnBC09DbsZG81JaE2QxB8Y7W36Z Mroi9XMxg3s805hQAQUvdG/poU8hN8BWdrnTm/+4eQQp7gDY1ePDmGM6bJC+OHOSnFtR/f+7 0zpKJ10cc7cBygGnl1yR3KjhFyAWUFvP4ZGziKCcpMwXZfe9PGuyA/YOubMphxIn3YsK2wrd faKZYX2GMZCZhMMcvx9IpQrxIJgU+VlwXu/O+Lk10VIPcxPJJwmpdI6HzcS8ZgG6IMcC444X XTuLaP8j2mgcMvYak3ScCykAEQEAAYkCPAQYAQgAJhYhBPqEtpWvK/eaIGQ/8fEEnHKfHGUn BQJbUocAAhsMBQkHhh+AAAoJEPEEnHKfHGUnReMP/RA2UhGQj+G4uBshkRLjpRysabdPqgQB dEBk6wYbio88Wg/2/hgY7UzmDDEwX3sZfQDcrI6+vIobI8uqstZID+WgAAa1JLfChMyVQnSy 0zfWMOABXscc5tGuvFRZvJklTissMFjXUwaREEKp4ZikTvJ/62MCjSdtrUhnPLvoTsHTKRKD ichE+b5A54alwsubTijw12O6N22r5IjZiiSZV0u7dsShyKw+7wCSax9fuBoE43NMYf+dnjMK nerAQYUcZWYMnk+EC8RaqYAxv6XZ2tKx1AkGGktwkQIBwrz9IlDSvJ3LWJ2UIIuLRTdngNgg GIL4zzuUa2F56FqskQIuYMaNETk6LYfalBDQ6TVLAcgCPQxp4k4i/PRsZ3lZ2ZhRHRYciOvm kp+I6EfHwllQpYrWs1thluBGqlJSVJgKl0IOFvKLsQ6KKfqzAwh6FxrO5qajp4viNIgtWoFw O5Bp0jgFTbH2OrMWIRfUdUCH1Djbuo65svhNj7FNsQVYzHDI+Nd1I/LOBoPc3UorRMF2M4JV kUR7skOHWUbPTSNUr7qc14NSMY3PKjGeVGAsBVHBPvmRx/Ss2tW/TpJWpxg4pmquFQSXuaYh Yf4FN8Sxy320pcr+FqN8AhZkYJcNY82OTtR5VEKRC/mYcyq61qXIKqngydn79bJjGxHipxyF FmEC Message-ID: <830f9986-9665-b279-a679-787c93d1df51@postgresql.org> Date: Fri, 24 May 2019 09:13:42 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:60.0) Gecko/20100101 Thunderbird/60.7.0 MIME-Version: 1.0 In-Reply-To: <20190524130123.GY2480@tamriel.snowman.net> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="vi4tQuGXGdLOW0MosvHJo42MwFbuQCLRA" List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --vi4tQuGXGdLOW0MosvHJo42MwFbuQCLRA Content-Type: multipart/mixed; boundary="PtLHSuxEZVJQb6LBD3ET87AkUFlcC1zDQ"; protected-headers="v1" From: "Jonathan S. Katz" To: Stephen Frost Cc: Magnus Hagander , Joe Conway , Tom Lane , Peter Eisentraut , pgsql-hackers , Noah Misch Message-ID: <830f9986-9665-b279-a679-787c93d1df51@postgresql.org> Subject: Re: initdb recommendations References: <9f46f065-ca80-f637-8c5d-a9877bcd5eab@postgresql.org> <10093.1558664907@sss.pgh.pa.us> <20190524023009.GL2480@tamriel.snowman.net> <20190524121306.GS2480@tamriel.snowman.net> <17041a05-0e28-f2b1-bf0c-fe375af66b45@joeconway.com> <20190524121904.GU2480@tamriel.snowman.net> <20190524123317.GW2480@tamriel.snowman.net> <20190524130123.GY2480@tamriel.snowman.net> In-Reply-To: <20190524130123.GY2480@tamriel.snowman.net> --PtLHSuxEZVJQb6LBD3ET87AkUFlcC1zDQ Content-Type: text/plain; charset=windows-1252 Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 5/24/19 9:01 AM, Stephen Frost wrote: > Greetings, >=20 > * Jonathan S. Katz (jkatz@postgresql.org) wrote: >> On 5/24/19 8:33 AM, Stephen Frost wrote: >>> We need to provide better documentation about how to get from md5 to >>> SCRAM, in my view. I'm not sure where that should live, exactly. >>> I really wish we had put more effort into making the migration easy t= o >>> do over a period of time, and we might actually have to do that befor= e >>> the packagers would be willing to make that change. >> >> +100...I think we should do this regardless, and I was already thinkin= g >> of writing something up around it. I would even suggest that we have >> said password upgrade documentation backpatched to 10. >=20 > Not sure that backpatching is necessary, but I'm not actively against > it. Well, for someone who wants to cut over and has to manually guide the process, a guide will help in absence of new development. >=20 > What I was really getting at though was the ability to have multiple > authenticator tokens active concurrently (eg: md5 AND SCRAM), with an > ability to use either one (idk, md5_or_scram auth method?), and then > automatically set both on password change until everything is using > SCRAM and then remove all MD5 stuff. >=20 > Or something along those lines. In other words, I'm talking about new > development work to ease the migration (while also providing some oft > asked about features, like the ability to do rolling passwords...). Cool, I have been thinking about a similar feature as well to help ease the transition (and fwiw was going to suggest it in my previous email). I think an interim step at least is to document how we can at least help ease the transition. Thanks, Jonathan --PtLHSuxEZVJQb6LBD3ET87AkUFlcC1zDQ-- --vi4tQuGXGdLOW0MosvHJo42MwFbuQCLRA Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEE+oS2la8r95ogZD/x8QSccp8cZScFAlzn7gYACgkQ8QSccp8c ZSf6KA/+IuDinUWrFA4PcP6uHc3Gf1OI4QkVvVabzaRLV0pajEU8aJAKLky0t6v1 hpjj7eaUjP/BPyhaG3zUPMnMoz00N71iTYXspZLmRbqCQlOwSDV2DuWyVYXd8F5R XajVFDA2HVGHvre/Sz3Vf3x0PuzU+kH7V7vtu1imSq9WCHgogaSRimsmLJaGdq4s ugOnW1Pu8vG1J8A/tSjgS5bwpFfb91+G9/AIWVuWcrWKHkYGXnp+L5/EkmNpxN6D 8+o0cMz0pcF4jcL/iYy5TMZvwib8Bl6ZqmEK6Bm+PxOvPSzoSQdyw1ve0pDBv23a eUue4gR5owtZCiOvNbIuBx9xpTXH2B9H7ZzWLuOtI9+xSDcTzH/+441Gvgv3rg13 SuipFZ7PWOKjoRYYmVB19ue/1sVr98vequVfs6bhsL9/L1g/9pLb0LWWrc+qWj7X w6y2k4Ao70JGGGuHVtg0bO3ZMYqRgNu3cS5V95+7wmyT5e7l+Mhe2nPrky5B1P3F 5nLdWlf+Cq8WyONatK515/oClrK2MGzlofXB8wMYw495AbGUGGa6jilc7jlSY6lD C8yBUYybMfLmWXAsx5eRVWgM4h7xyUim9DBvMy5saYhCXHaUrz4SKLNQb9L3Ufi0 GHEsO7P/SXdE2PHqfYqCNXIOmI7aQjHms3WYr2z5/jSlj1PTQuw= =Mo7M -----END PGP SIGNATURE----- --vi4tQuGXGdLOW0MosvHJo42MwFbuQCLRA--