From: Tom Lane <tgl@sss.pgh.pa.us>
To: Jeff Janes <jeff.janes@gmail.com>
Cc: Joe Conway <mail@joeconway.com>
Cc: Heikki Linnakangas <hlinnaka@iki.fi>
Cc: Robert Haas <robertmhaas@gmail.com>
Cc: Michael Paquier <michael.paquier@gmail.com>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: scram and \password
Date: Tue, 14 Mar 2017 17:14:54 -0400
Message-ID: <16350.1489526094@sss.pgh.pa.us> (raw)
In-Reply-To: <CAMkU=1wDS_RE_DXUDPF3s4EE8ENp3-svmcvmKfmSVa6QSNyV7g@mail.gmail.com>
References: <CAMkU=1wfBgFPbfAMYZQE78p=VhZX7nN86aWkp0QcCp=+KxZ=bg@mail.gmail.com>
<CAB7nPqSELwmfwgOt8U_rK15sHWuGeLhsWYihRtq9ADC3MZ=HTg@mail.gmail.com>
<CA+TgmoY3VmPTn8gaKhx2fXXiMX_U2Ozf3qMXyVa+zsuMMox1HA@mail.gmail.com>
<CAB7nPqTZNZkbezTZ3WrTBU42cAuAGjyukJAs=iw=KN4GZGoXxA@mail.gmail.com>
<CA+TgmoYHvtOYex0N0DTm3hAvgZezZZpH789a13MzHDh_VgG9Ew@mail.gmail.com>
<29551.1489459676@sss.pgh.pa.us>
<e4c3807b-fc53-5657-5372-b156e673a9d5@iki.fi>
<39228d95-2560-19e4-d907-b1fd5a75fd23@joeconway.com>
<6425.1489506016@sss.pgh.pa.us>
<CAMkU=1wDS_RE_DXUDPF3s4EE8ENp3-svmcvmKfmSVa6QSNyV7g@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
Jeff Janes <jeff.janes@gmail.com> writes:
> On Tue, Mar 14, 2017 at 8:40 AM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>> Why exactly would anyone want "md5 only"? I should think that "scram
>> only" is a sensible pg_hba setting, if the DBA feels that md5 is too
>> insecure, but I do not see the point of "md5 only" in 2017. I think
>> we should just start interpreting that as "md5 or better".
> Without md5-only, a user who uses \password to change their password from a
> newer client would lock themselves out of connecting again from older
> clients. As a conscious decision (either of the DBA or the user) that
> would be OK, but to have it happen by default would be unfortunate.
That's a point, but what it implies is that \password needs some input
from the user about whether to generate a SCRAM or MD5-hashed password.
It would be a fatal error to try to drive that off the auth method
that had been used for the current connection, even if \password had a
way to find that out. By definition, your concern is about clients
other than the current one, which might well be coming in from other
addresses and getting challenges based on other pg_hba entries. So
you can't say that "I came in on a SCRAM connection" is sufficient
reason to generate a SCRAM password.
In short, I don't think that argument refutes my position that "md5"
in pg_hba.conf should be understood as allowing SCRAM passwords too.
regards, tom lane
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: tgl@sss.pgh.pa.us, jeff.janes@gmail.com, mail@joeconway.com, hlinnaka@iki.fi, robertmhaas@gmail.com, michael.paquier@gmail.com
Subject: Re: scram and \password
In-Reply-To: <16350.1489526094@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox