From: Jonathan S. Katz <jkatz@postgresql.org>
To: Jeff Davis <pgsql@j-davis.com>
To: Stephen Frost <sfrost@snowman.net>
To: Michael Paquier <michael@paquier.xyz>
Cc: pgsql-hackers@postgresql.org
Subject: Re: Add "password_protocol" connection parameter to libpq
Date: Fri, 9 Aug 2019 16:27:16 -0400
Message-ID: <071e45a6-97f7-1614-371c-98ecb03aed65@postgresql.org> (raw)
In-Reply-To: <609482826475e0063c7d71b2449ae31c0d61b232.camel@j-davis.com>
References: <227015d8417f2b4fef03f8966dbfa5cbcc4f44da.camel@j-davis.com>
<20190809030021.GG3194@paquier.xyz>
<3bbf5968ea705700a2605d6db74d8510bea7940b.camel@j-davis.com>
<20190809100922.GI3194@paquier.xyz>
<20190809132850.GL16436@tamriel.snowman.net>
<609482826475e0063c7d71b2449ae31c0d61b232.camel@j-davis.com>
On 8/9/19 11:51 AM, Jeff Davis wrote:
> On Fri, 2019-08-09 at 09:28 -0400, Stephen Frost wrote:
>> Having an 'any' option, as mentioned before, could be an alternative
>> though.
>
> ...
>
>> I agree with the point that there isn't any guarantee that it'll
>> always
>> be clear-cut as to which of two methods is "better".
>>
>> From a user perspective, it seems like the main things are "don't
>> send
>> my password in the clear to the server", and "require channel binding
>> to
>> prove there isn't a MITM". I have to admit that I like the idea of
>> requiring scram to be used and not allowing md5 though.
>
> So it seems like we are leaning toward:
>
> password_protocol = any | {plaintext,md5,scram-sha-256,scram-sha-
> 256-plus}[,...]
First, thanks for proposing / working on this, I like the idea! :) Happy
to test/review.
As long as this one can handle the current upgrade path that's in place
for going from md5 to SCRAM (which AIUI it should) this makes sense to
me. As stated above, there is a clear hierarchy.
I would almost argue that "plaintext" shouldn't even be an option...if
you have "any" set (arguably default?) then plaintext is available. With
our currently supported versions + driver ecosystem, I hope no one needs
to support a forced plaintext setup.
>
> Or maybe:
>
> channel_binding = {disable|prefer|require}
> password_plaintext = {disable|enable}
> password_md5 = {disable|enable}
>
> That seems reasonable. It's three options, but no normal use case would
> need to set more than two, because channel binding forces scram-sha-
> 256-plus.
Seems to be a lot to configure. I'm more of a fan of the previous
method; it'd work nicely with how we've presently defined things and
should be easy to put into a DSN/URI/env variable.
Thanks,
Jonathan
Attachments:
[application/pgp-signature] signature.asc (832B, ../071e45a6-97f7-1614-371c-98ecb03aed65@postgresql.org/2-signature.asc)
download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: jkatz@postgresql.org, pgsql@j-davis.com, sfrost@snowman.net, michael@paquier.xyz
Subject: Re: Add "password_protocol" connection parameter to libpq
In-Reply-To: <071e45a6-97f7-1614-371c-98ecb03aed65@postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox