Feedback-ID: i76984098:Fastmail
Message-ID: <104ef218-379a-4ca5-9918-29ab68a9405b@aklaver.com>
Date: Thu, 6 Feb 2025 19:16:45 -0800
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Help in vetting Switch from "MD5" to "scram-sha-256" - during DB
 Upgrade from EC2- PGS - Community Edn ver 13.X to 15.X
To: Bharani SV-forum <esteembsv-forum@yahoo.com>,
 Greg Sabino Mullane <htamfids@gmail.com>,
 Ron Johnson <ronljohnsonjr@gmail.com>
Cc: pgsql-general <pgsql-general@postgresql.org>
References: <0558ddd4d71641bdb41fa49b2425f73c@safrangroup.com>
 <CANzqJaC1Uk4H=55vV_jbFYMuD1f9Bb_4Y9WKvkZA3bt92bEUnw@mail.gmail.com>
 <498dfb34-4dd7-4f48-8188-355e1488d7e6@aklaver.com>
 <1061066336.5835157.1733316137292@mail.yahoo.com>
 <CAKAnmmKZdhnhdNRd3OgDyEco9OPkT=qA_TeWMFMRvUM9pXauKg@mail.gmail.com>
 <1482982714.8486017.1735661703839@mail.yahoo.com>
 <1763130721.4001842.1737733841628@mail.yahoo.com>
 <c3fc88ef-d155-4455-bc01-2c569b401998@aklaver.com>
 <132487461.4068668.1737741687606@mail.yahoo.com>
 <0dc06cb7-33cc-43ba-a95f-535fdf0a0439@aklaver.com>
 <1751608443.5432365.1738081421269@mail.yahoo.com>
 <74599d1d-c8a2-4e59-a50d-019dcc973de8@aklaver.com>
 <200665967.5560583.1738095230696@mail.yahoo.com>
 <21b5d62a-19d1-413f-9d5e-d681cd2bb91b@aklaver.com>
 <47454513.6047834.1738179914107@mail.yahoo.com>
 <1841861276.9581730.1738888679871@mail.yahoo.com>
 <fabc9547-1de0-4efa-baf5-124d91e3fab5@aklaver.com>
 <56243553.9616888.1738893835649@mail.yahoo.com>
Content-Language: en-US
From: Adrian Klaver <adrian.klaver@aklaver.com>
In-Reply-To: <56243553.9616888.1738893835649@mail.yahoo.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Archived-At: <https://www.postgresql.org/message-id/104ef218-379a-4ca5-9918-29ab68a9405b%40aklaver.com>
Precedence: bulk

On 2/6/25 18:03, Bharani SV-forum wrote:
> Adrian
> TQ for your valuable input's.
> 
> *Additional Qsn*
> 
> Assume  DB ver = 15.X
> 
> By default encryption = scram-sha-256, Assume pg_hba.conf is quoted the 
> usage as MD5 for the
>   dbuserid "test_usr_1"
> 
> *e.g .)*
> *
> *
> hostssl   all test_usr_1 10.20.30.40  md5
> 
> i.e .)
> Assume if the respective db userid (e.g test_usr_1) is quoted for usage 
> md5,  in pg_hba.conf, No Need to Change, the respective *Role/Userid 
> password mandatorily.* DB System will allow to use existing password 
> with the old MD5 passwords still work, as long as the authentication 
> method in pg_hba.conf is set to md5

Yes.

It gives you time to switch the passwords to scram-sha-256 encryption 
after you do the migration. In other words you can have both md5 and 
scram-sha-256 passwords in use without changing the pg_hba.conf lines. 
Once the transition to scram-sha-256 is done then you can change the 
lines to scram-sha-256 and that will prevent use of m5 passwords going 
forward.

> 
> e.g.) hostssl     all         LOGS_USER_1 10.9.0.0/21    md5
> 
> Is their,  any security problem due to usage of md5 in the pg_hba.conf 
> file  with underlying db =15.X ?

You are currently using it, have there been any issues?

If not then moving to Postgres 15 won't change that.

> 
> I am Aware ,
> (a) *MD5 hash algorithm is nowadays no longer considered secure against 
> determined attacks.*
> *(a)  MD5 method cannot be used with the db_user_namespace feature.
> *
> 
> 
> 


-- 
Adrian Klaver
adrian.klaver@aklaver.com