MIME-Version: 1.0
References: <CAHKeUX8D-c=Y8su6eFLZXJ09VOVLnSUHYD-649NoXW8cHdBPhg@mail.gmail.com>
In-Reply-To: <CAHKeUX8D-c=Y8su6eFLZXJ09VOVLnSUHYD-649NoXW8cHdBPhg@mail.gmail.com>
From: Greg Sabino Mullane <htamfids@gmail.com>
Date: Wed, 9 Jul 2025 10:58:15 -0400
Message-ID: <CAKAnmmK9hQE-Cs2rVx_7brmubA1qCyNPmnOf=eA2HuxPwMy9=A@mail.gmail.com>
Subject: Re: Password Encryption and Connection Issues
To: =?UTF-8?Q?Alpaslan_AKDA=C4=9E?= <alpaslanakdag@gmail.com>
Cc: "pgsql-general@lists.postgresql.org" <pgsql-general@lists.postgresql.org>
Content-Type: multipart/alternative; boundary="00000000000095daa706398050a9"
Archived-At: <https://www.postgresql.org/message-id/CAKAnmmK9hQE-Cs2rVx_7brmubA1qCyNPmnOf%3DeA2HuxPwMy9%3DA%40mail.gmail.com>
Precedence: bulk

--00000000000095daa706398050a9
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Wed, Jul 9, 2025 at 9:57=E2=80=AFAM Alpaslan AKDA=C4=9E <alpaslanakdag@g=
mail.com>
wrote:

> Is it expected behavior that users created with scram-sha-256 passwords
> can still connect via md5 in pg_hba.conf?


Yes. From the docs:

> To ease transition from the md5 method to the newer SCRAM method, if md5 =
is
> specified as a method in pg_hba.conf but the user's password on the
> server is encrypted for SCRAM (see below), then SCRAM-based authenticatio=
n
> will automatically be chosen instead.


You can think of "md5" inside pg_hba.conf as "md5 or better"

As a result, some users are able to connect, while others cannot.


Can you expand on this? Nothing you have done should be preventing logins,
as far as I can tell.

Best solution: Upgrade everyone to scram, then change md5 to scram in
pg_hba.conf and never look back.

--=20
Cheers,
Greg

--
Crunchy Data - https://www.crunchydata.com
Enterprise Postgres Software Products & Tech Support

--00000000000095daa706398050a9
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Wed, Jul 9, 2025 at 9:57=E2=80=AFAM Al=
paslan AKDA=C4=9E &lt;<a href=3D"mailto:alpaslanakdag@gmail.com">alpaslanak=
dag@gmail.com</a>&gt; wrote:</div><blockquote class=3D"gmail_quote" style=
=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding=
-left:1ex">Is it expected behavior that users created with <code>scram-sha-=
256</code> passwords can still connect via <code>md5</code> in <code>pg_hba=
.conf</code>?</blockquote><div><br></div><div>Yes. From the docs:=C2=A0</di=
v><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;borde=
r-left:1px solid rgb(204,204,204);padding-left:1ex"><span style=3D"color:rg=
b(0,0,0);font-family:&quot;Open Sans&quot;,sans-serif;font-size:18px">To ea=
se transition from the=C2=A0</span><code class=3D"gmail-literal" style=3D"b=
ox-sizing:border-box;font-family:monospace,monospace;font-size:18px;color:r=
gb(0,0,0);background-color:rgb(248,249,250);border-radius:0.25rem;margin:0.=
6rem 0px">md5</code><span style=3D"color:rgb(0,0,0);font-family:&quot;Open =
Sans&quot;,sans-serif;font-size:18px">=C2=A0method to the newer SCRAM metho=
d, if=C2=A0</span><code class=3D"gmail-literal" style=3D"box-sizing:border-=
box;font-family:monospace,monospace;font-size:18px;color:rgb(0,0,0);backgro=
und-color:rgb(248,249,250);border-radius:0.25rem;margin:0.6rem 0px">md5</co=
de><span style=3D"color:rgb(0,0,0);font-family:&quot;Open Sans&quot;,sans-s=
erif;font-size:18px">=C2=A0is specified as a method in=C2=A0</span><code cl=
ass=3D"gmail-filename" style=3D"box-sizing:border-box;font-family:monospace=
,monospace;font-size:18px;color:rgb(0,0,0);background-color:rgb(248,249,250=
);border-radius:0.25rem;margin:0.6rem 0px">pg_hba.conf</code><span style=3D=
"color:rgb(0,0,0);font-family:&quot;Open Sans&quot;,sans-serif;font-size:18=
px">=C2=A0but the user&#39;s password on the server is encrypted for SCRAM =
(see below), then SCRAM-based authentication will automatically be chosen i=
nstead.</span></blockquote><div><br></div><div>You can think of &quot;md5&q=
uot; inside pg_hba.conf as &quot;md5 or better&quot;=C2=A0</div><div><br></=
div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;bor=
der-left:1px solid rgb(204,204,204);padding-left:1ex">As a result, some use=
rs are able to connect, while others cannot.</blockquote><div><br></div><di=
v>Can you expand on this? Nothing you have done should be preventing logins=
, as far as I can tell.</div><div><br></div><div>Best solution: Upgrade eve=
ryone to scram, then change md5 to scram in pg_hba.conf and never look back=
.</div><div><br></div><span class=3D"gmail_signature_prefix">-- </span><br>=
<div dir=3D"ltr" class=3D"gmail_signature"><div dir=3D"ltr"><div>Cheers,</d=
iv><div>Greg</div><div><br></div><div>--</div><div>Crunchy Data - <a href=
=3D"https://www.crunchydata.com" target=3D"_blank">https://www.crunchydata.=
com</a></div><div>Enterprise Postgres Software Products &amp; Tech Support<=
/div><div><br></div></div></div></div>

--00000000000095daa706398050a9--