Message-ID: <55CCE12B.4030306@agliodbs.com>
Date: Thu, 13 Aug 2015 11:25:47 -0700
From: Josh Berkus <josh@agliodbs.com>
Organization: PostgreSQL Experts Inc.
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
 rv:31.0) Gecko/20100101 Thunderbird/31.8.0
MIME-Version: 1.0
To: Stephen Frost <sfrost@snowman.net>,
 Robert Haas <robertmhaas@gmail.com>
CC: Peter Eisentraut <peter_e@gmx.net>, Heikki Linnakangas <hlinnaka@iki.fi>,
 Michael Paquier <michael.paquier@gmail.com>,
 pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: WIP: SCRAM authentication
References: 
 <CA+TgmobMFiHiHt2_weFhZ-99kQNQz+h3mkTzm1aOX4ZMwOH-Yg@mail.gmail.com>
 <55CA4085.30101@gmx.net>
 <CA+TgmoYVE3Cg_HG=uZ_2NfMBbRstgNVMsOeVxHbfCUZfDhfxaA@mail.gmail.com>
 <55CB5D38.5090503@gmx.net>
 <CA+TgmoZq6T=jsEr5sAW5Q3_63E4zaoim918e5fkb187AVmhr2g@mail.gmail.com>
 <55CBA425.5070803@gmx.net> <20150812200938.GM3685@tamriel.snowman.net>
 <CA+TgmoYRkGAYC8XAz91qiwDK=wEqXgUbCoaPgiZDnde0cMSj5Q@mail.gmail.com>
 <20150812203732.GN3685@tamriel.snowman.net>
 <CA+Tgmob0T6MgQZ2fFityAsyXiX-rni0hU=LVtaFUv0oo7cdz2w@mail.gmail.com>
 <20150813013607.GS3685@tamriel.snowman.net>
 <WM!f47f2028fc1867e14926553022b78cd909807c8421cfe79fc83dece946e5dacb3c67bbaa75c363e878fc83c4680f7899!@asav-1.01.com>
In-Reply-To: 
 <WM!f47f2028fc1867e14926553022b78cd909807c8421cfe79fc83dece946e5dacb3c67bbaa75c363e878fc83c4680f7899!@asav-1.01.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

On 08/12/2015 06:36 PM, Stephen Frost wrote:
> I attempted to address that also by stating that, should an attacker
> compromise a system with the goal of gaining the cleartext password,
> they would attempt the following, in order:
> 
> 1) attempt to compromise a superuser account, if not already done, and
> then modify the system to get the 'password' auth mechanism to be used
> whereby the password is sent in the clear
> 
> 2) change the existing password, or encourge the user to do so and
> somehow capture that activity
> 
> 3) social engineering attacks
> 
> 4) attempt to crack the md5 hash
> 
> 5) attempt to crack the SCRAM password verifier
> 
> 6) try to work out a way to use both the md5 hash and the SCRAM password
> verifier to figure out the password
> 

I don't feel like you've correctly assessed the risk inherent in the
md5 auth method, which is that, having captured an md5auth string by
whatever means, and attacker can reuse that md5 string on other
databases in the network *without* cracking it.  That's the biggest risk
as long as md5 is present.

Aside from code complexity, the user security concern with a "multiple
verifier per role" approach is that the DBAs would never remember to
completely disable md5auth and would capture md5 hashes either in flight
or from backups.  This approach can be used to capture an md5hash from a
non-critical database which is poorly secured, and then re-use it
against an important database.

Now, the counter-argument to this is that a DBA is just as likely to
rememeber to remove md5 verifiers as she is to remember to remove roles
with md5auth.

Regardless of the approach we take, encouraging users to migrate is
going to be more of a matter of documentation, publicity, and
administrative tools than one of multiple verifiers vs. multiple roles.
 That is, giving DBAs the ability to see and log who's using what kind
of verifier, and what account has what verifier(s) available, will make
more of a difference.

-- 
Josh Berkus
PostgreSQL Experts Inc.
http://pgexperts.com


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers