MIME-Version: 1.0
References: <20250112222828.b36hpzm3ulfzlkws@hjp.at> <372571.1736722760@sss.pgh.pa.us>
In-Reply-To: <372571.1736722760@sss.pgh.pa.us>
From: Ron Johnson <ronljohnsonjr@gmail.com>
Date: Mon, 13 Jan 2025 12:19:06 -0500
Message-ID: <CANzqJaDxwg_zS3LKZPq1Yj_sJV-T_qWT=mCF-ptEOcDHUJ+nzQ@mail.gmail.com>
Subject: Re: Automatic upgrade of passwords from md5 to scram-sha256
To: pgsql-general <pgsql-general@postgresql.org>
Content-Type: multipart/alternative; boundary="000000000000f485aa062b99a404"
Archived-At: <https://www.postgresql.org/message-id/CANzqJaDxwg_zS3LKZPq1Yj_sJV-T_qWT%3DmCF-ptEOcDHUJ%2BnzQ%40mail.gmail.com>
Precedence: bulk

--000000000000f485aa062b99a404
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Sun, Jan 12, 2025 at 5:59=E2=80=AFPM Tom Lane <tgl@sss.pgh.pa.us> wrote:
 [snip]

> I think this idea is a nonstarter, TLS or not.  We're generally moving
> in the direction of never letting the server see cleartext passwords.
> It's already possible to configure libpq to refuse such requests
> (see require_auth parameter), although that hasn't been made the
> default.
>

ALTER ROLE xxx WITH PASSWORD accepts hashed values, so a client with the
SCRAM-SHA algorithm could:
1. remember the password that was just used to log in,
2. generate the new hash,
3. send that as an ALTER ROLE statement.

Anything which shows up in the logs would be no different than when someone
types ALTER ROLE ... WITH PASSWORD from the psql prompt.

--=20
Death to <Redacted>, and butter sauce.
Don't boil me, I'm still alive.
<Redacted> lobster!

--000000000000f485aa062b99a404
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr">On Sun, Jan 12, 2025 at =
5:59=E2=80=AFPM Tom Lane &lt;<a href=3D"mailto:tgl@sss.pgh.pa.us" target=3D=
"_blank">tgl@sss.pgh.pa.us</a>&gt; wrote:</div><div class=3D"gmail_quote"><=
div>=C2=A0[snip]</div><blockquote class=3D"gmail_quote" style=3D"margin:0px=
 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">I t=
hink this idea is a nonstarter, TLS or not.=C2=A0 We&#39;re generally movin=
g<br>
in the direction of never letting the server see cleartext passwords.<br>
It&#39;s already possible to configure libpq to refuse such requests<br>
(see require_auth parameter), although that hasn&#39;t been made the<br>
default.<br></blockquote></div><div><br clear=3D"all"></div><div>ALTER ROLE=
 xxx WITH PASSWORD accepts hashed values, so a client with the SCRAM-SHA al=
gorithm could:</div><div>1. remember the password that was just used to log=
 in,</div><div>2. generate the new hash,=C2=A0</div><div>3. send that as an=
 ALTER ROLE statement.</div><div><br></div><div>Anything which shows up in =
the logs would be no different than when someone types ALTER ROLE ... WITH =
PASSWORD from the psql prompt.</div><div><br></div><span class=3D"gmail_sig=
nature_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_signature"><di=
v dir=3D"ltr">Death to &lt;Redacted&gt;, and butter sauce.<div>Don&#39;t bo=
il me, I&#39;m still alive.<br><div><div>&lt;Redacted&gt; lobster!</div></d=
iv></div></div></div></div>
</div>

--000000000000f485aa062b99a404--