Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kwy5E-0000z8-Qt for pgsql-docs@arkaria.postgresql.org; Wed, 06 Jan 2021 01:57:56 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1kwy5D-0001e2-JH for pgsql-docs@arkaria.postgresql.org; Wed, 06 Jan 2021 01:57:55 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kwy5D-0001du-Dg for pgsql-docs@lists.postgresql.org; Wed, 06 Jan 2021 01:57:55 +0000 Received: from out5-smtp.messagingengine.com ([66.111.4.29]) by magus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kwy5B-0005qc-7r for pgsql-docs@lists.postgresql.org; Wed, 06 Jan 2021 01:57:55 +0000 Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id 8303D5C01C0; Tue, 5 Jan 2021 20:57:51 -0500 (EST) Received: from mailfrontend2 ([10.202.2.163]) by compute1.internal (MEProxy); Tue, 05 Jan 2021 20:57:51 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paquier.xyz; h= date:from:to:cc:subject:message-id:references:mime-version :content-type:in-reply-to; s=fm3; bh=Q5tkjMSgqrmpWoCh+mtGA6tzAMH fyQQQBv7PETgIgNU=; b=XuBtNvqtEIn0FJMduYztCRYCsKZ2cwj2w7Xsxywpj4y AebAZp/2ZSg3c1Mdfts/ojx61Xb+JManJz2K6gJVGvYerjp8zokZpQ5ladCvnxgK HWJjlO7c70w9rvr2d/Z+FFp8YpnFNA/WYolnr8Cf/C9Bx5o/CXyqUBDs01k7LT+F 1jjyLGRB9MlcM/VLOHrQYzhItMK2vElx2mT6wRUKqGUcf+2NOpnFJmHtQbNsS1+Q ApkQzN0VdA7KclmP8mdGWuqjDa2JVf0bn/aji3GXW2CJg1Jl2Hx311SjKvmYytd4 Z7mlx7A0Xg4sVJ7wIFmRLUuQfTzNpSMvFDtGxLtmFGQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm1; bh=Q5tkjM SgqrmpWoCh+mtGA6tzAMHfyQQQBv7PETgIgNU=; b=FK0KqQM21v/PfQRJ94WJo8 zRVBbWwNMpyHUWBiNXLdEWHvcCde+Sg6p+hT3gg+kyI7e0WtblrpqCD0ZxRhFWek YKEQkwO6OW2rsOVDJMFXcNeC69pMc4fkdFqyZgqNjX/gOdLsmkDz1xb3k1L4+l/z uYOPZOA/xngGRVFck58x7DAGGETb6nr802sIqkcMdmCPuBxdlJD2LFqkI3Vhb9tq ZXChYIdDTsrGuYKUsmoXFgvc7ExCujMuz7m+NIJPpkYgtNB3ziPdk9l39LiDk+wY ATZxd41nLwQI5YkhgxCtymGASdncTLEVV4XCCkqDkyNuSux8j5Y8VvZB1bLNBdfQ == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedujedrvdefkedggedtucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmne gfrhhlucfvnfffucdljedtmdenucfjughrpeffhffvuffkfhggtggujgesghdtreertddt vdenucfhrhhomhepofhitghhrggvlhcurfgrqhhuihgvrhcuoehmihgthhgrvghlsehprg hquhhivghrrdighiiiqeenucggtffrrghtthgvrhhnpedvgeduuefhtdeuleettdevjeeh heeiveeuieegleetgeeljeelieeuieehgeevhfenucfkphepudduuddruddtvddrudektd drudekheenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhm pehmihgthhgrvghlsehprghquhhivghrrdighiii X-ME-Proxy: Received: from paquier.xyz (ee0822lan1.rev.em-net.ne.jp [111.102.180.185]) by mail.messagingengine.com (Postfix) with ESMTPA id E49C71080059; Tue, 5 Jan 2021 20:57:49 -0500 (EST) Date: Wed, 6 Jan 2021 10:57:46 +0900 From: Michael Paquier To: "Jonathan S. Katz" Cc: sebihoorens@gmail.com, pgsql-docs@lists.postgresql.org Subject: Re: scram-sha-256 authentication Message-ID: References: <160977988728.3264.12890569380100648489@wrigleys.postgresql.org> <0707a341-0c2e-3fe4-fe65-607bea83aced@postgresql.org> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="Qn28itaV49XZtu3Y" Content-Disposition: inline In-Reply-To: <0707a341-0c2e-3fe4-fe65-607bea83aced@postgresql.org> List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --Qn28itaV49XZtu3Y Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Jan 05, 2021 at 09:12:58AM -0500, Jonathan S. Katz wrote: > I am not sure what your end goal is, but there are a few ways to create > the hashed SCRAM verifier: >=20 > - Using the \password flag in "psql" > - Using one of the connection drivers that interfaces with libpq's > PQencryptPasswordConn function[2] > - Some driver's handle the password hashing independently Another thing to be careful about is the value of password_encryption in postgresql.conf. The default has been changed to scram-sha-256 in c7eab0e, meaning that this change will be available in Postgres 14~. But if your environment is using the default configuration of 11, that may be set to "md5". -- Michael --Qn28itaV49XZtu3Y Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAl/1GRkACgkQnvQgOdby QH28ZA/+PYf8pbmFh0hyFOTCD/2JnovIoldHXv19Ie9gryOIct5FvFapzLUTax50 7pZ7m6/SpK25RlKgYgDU756Y+QKe5rk8VTFM+MlCrI+CthcLPNkUte3B6AiMkIy/ ieBkmqidIPpfQr7fVnGpam14CG8VlZIwPyVtiVOuZAvuApK+tJ/4Czqr+9w4IgaB nkFTGIGtx3l/FaD7BAdwSDfPVjY/0/e/OlWz0dsPENjcKRjZLvR4T2ADXgvVMkUQ 5q6Yqz7GJLt/rtbtw078vHAvoTNJAfzsvh1nYjP0ertHZBLllo6tjpvYum4sQyqX HClvoP+HwZ8fQX9VaGGS9f2Hrq6w1HKII+FalfdlgiM9yMOjX/qL/NeVAURAViLo AyjafwiXDxhzjs8FyuS49K1tsgDvHIDkqKpgXFGrBK/BkcCE9CSHs7aNEwPdAmhX 1G/TSLTksQvoCRQxFenuwSTCl6UZx8X1wmxxfgTEVGpRn3NRNdMYWjkYbsvazLvM zwNrR2ADM7oVlHFVdR/QX6xUH9O2vmQNuRj34knpEapsY+knz6XaISjIcajbagFM +tBCh3400ioYFyfJa09x7c6JIM3FUO8rDE7eCIUCyjmiAZLzdHzjxXqBdbSdJ0w/ CL6rJoC4a2GitLaCivdlGYryEloTV9yDfvfcZJJWk2S3NxQi250= =Q8fI -----END PGP SIGNATURE----- --Qn28itaV49XZtu3Y--