From: Nathan Bossart <nathandbossart@gmail.com>
To: Andrew Dunstan <andrew@dunslane.net>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Heikki Linnakangas <hlinnaka@iki.fi>
Cc: pgsql-hackers@postgresql.org
Subject: Re: sunsetting md5 password support
Date: Fri, 11 Oct 2024 16:36:27 -0500
Message-ID: <ZwmaW2AeUjBJGHgw@nathan> (raw)
In-Reply-To: <17ccc98a-108a-415d-a38c-f12b7baab90d@dunslane.net>
References: <ZwbfpJJol7lDWajL@nathan>
<7e9e3d30-f7f4-460f-a626-6cfad419d6cd@iki.fi>
<76396e05-0724-4b17-9194-2875df40feb8@dunslane.net>
<2735114.1728599306@sss.pgh.pa.us>
<17ccc98a-108a-415d-a38c-f12b7baab90d@dunslane.net>
On Fri, Oct 11, 2024 at 09:47:58AM -0400, Andrew Dunstan wrote:
> On 2024-10-10 Th 6:28 PM, Tom Lane wrote:
>> On the whole I agree with Heikki's comment that we should just
>> do it (disallow MD5, full stop) whenever we feel that enough
>> time has passed. These intermediate states are mostly going to
>> add headaches. Maybe we could do something with an intermediate
>> release that just emits warnings, without any feature changes.
>
> I also agree with this.
Here is a first attempt at a patch for marking MD5 passwords as deprecated.
It's quite bare-bones at the moment, so I anticipate future revisions will
add more content. Besides sprinkling several deprecation notices
throughout the documentation, this patch teaches CREATE ROLE and ALTER ROLE
to emit warnings when setting MD5 passwords. A new GUC named
md5_password_warnings can be set to "off" to disable these warnings. I
considered adding even more warnings (e.g., when authenticating), but I
felt that would be far too noisy.
--
nathan
From a20f43d93562c4234de228ae3f0afae12750d7a0 Mon Sep 17 00:00:00 2001
From: Nathan Bossart <nathan@postgresql.org>
Date: Fri, 11 Oct 2024 16:21:09 -0500
Subject: [PATCH v1 1/1] Deprecate MD5 passwords.
MD5 has been considered to be unsuitable for use as a cryptographic
hash algorithm for some time. Furthermore, MD5 password hashes in
PostgreSQL are vulnerable to pass-the-hash attacks, i.e., knowing
the username and hashed password is sufficient to authenticate.
The SCRAM-SHA-256 method added in v10 is not subject to these
problems and is considered to be superior to MD5.
This commit marks MD5 password support in PostgreSQL as deprecated
and to be removed in a future release. The documentation now
contains several deprecation notices, and CREATE ROLE and ALTER
ROLE now emit deprecation warnings when setting MD5 passwords. The
warnings can be disabled by setting the md5_password_warnings
parameter to "off".
Reviewed-by: ???
Discussion: https://postgr.es/m/ZwbfpJJol7lDWajL%40nathan
---
contrib/passwordcheck/expected/passwordcheck.out | 3 +++
.../passwordcheck/expected/passwordcheck_1.out | 6 ++++++
doc/src/sgml/catalogs.sgml | 9 +++++++++
doc/src/sgml/client-auth.sgml | 8 ++++++++
doc/src/sgml/config.sgml | 8 ++++++++
doc/src/sgml/libpq.sgml | 9 +++++++++
doc/src/sgml/protocol.sgml | 8 ++++++++
doc/src/sgml/ref/create_role.sgml | 8 ++++++++
doc/src/sgml/runtime.sgml | 10 ++++++++++
src/backend/libpq/crypt.c | 10 ++++++++++
src/backend/utils/misc/guc_tables.c | 9 +++++++++
src/backend/utils/misc/postgresql.conf.sample | 1 +
src/include/libpq/crypt.h | 3 +++
src/test/modules/test_misc/t/003_check_guc.pl | 2 +-
src/test/regress/expected/password.out | 15 +++++++++++++++
src/test/regress/expected/password_1.out | 9 +++++++++
16 files changed, 117 insertions(+), 1 deletion(-)
diff --git a/contrib/passwordcheck/expected/passwordcheck.out b/contrib/passwordcheck/expected/passwordcheck.outindex 2027681daf..2f91b53b8a 100644--- a/contrib/passwordcheck/expected/passwordcheck.out+++ b/contrib/passwordcheck/expected/passwordcheck.out@@ -13,6 +13,9 @@ ALTER USER regress_passwordcheck_user1 PASSWORD 'alessnicelongpassword';
ERROR: password must contain both letters and nonletters
-- encrypted ok (password is "secret")
ALTER USER regress_passwordcheck_user1 PASSWORD 'md592350e12ac34e52dd598f90893bb3ae7';
+WARNING: setting an MD5-encrypted password+DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.+HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
-- error: password is user name
ALTER USER regress_passwordcheck_user1 PASSWORD 'md507a112732ed9f2087fa90b192d44e358';
ERROR: password must not equal user name
diff --git a/contrib/passwordcheck/expected/passwordcheck_1.out b/contrib/passwordcheck/expected/passwordcheck_1.outindex 5d8d5dcc1c..ebb72956b0 100644--- a/contrib/passwordcheck/expected/passwordcheck_1.out+++ b/contrib/passwordcheck/expected/passwordcheck_1.out@@ -13,6 +13,12 @@ ALTER USER regress_passwordcheck_user1 PASSWORD 'alessnicelongpassword';
ERROR: password must contain both letters and nonletters
-- encrypted ok (password is "secret")
ALTER USER regress_passwordcheck_user1 PASSWORD 'md592350e12ac34e52dd598f90893bb3ae7';
+WARNING: setting an MD5-encrypted password+DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.+HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
-- error: password is user name
ALTER USER regress_passwordcheck_user1 PASSWORD 'md507a112732ed9f2087fa90b192d44e358';
+WARNING: setting an MD5-encrypted password+DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.+HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
DROP USER regress_passwordcheck_user1;
diff --git a/doc/src/sgml/catalogs.sgml b/doc/src/sgml/catalogs.sgmlindex 964c819a02..0b9ca087c8 100644--- a/doc/src/sgml/catalogs.sgml+++ b/doc/src/sgml/catalogs.sgml@@ -1618,6 +1618,15 @@
will store the md5 hash of <literal>xyzzyjoe</literal>.
</para>
+ <warning>+ <para>+ Support for MD5-encrypted passwords is deprecated and will be removed in a+ future release of <productname>PostgreSQL</productname>. Refer to+ <xref linkend="auth-password"/> for details about migrating to another+ password type.+ </para>+ </warning>+
<para>
If the password is encrypted with SCRAM-SHA-256, it has the format:
<synopsis>
diff --git a/doc/src/sgml/client-auth.sgml b/doc/src/sgml/client-auth.sgmlindex 51343de7ca..60a1d16288 100644--- a/doc/src/sgml/client-auth.sgml+++ b/doc/src/sgml/client-auth.sgml@@ -1260,6 +1260,14 @@ omicron bryanh guest1
server is encrypted for SCRAM (see below), then SCRAM-based
authentication will automatically be chosen instead.
</para>
++ <warning>+ <para>+ Support for MD5-encrypted passwords is deprecated and will be removed+ in a future release of <productname>PostgreSQL</productname>. Refer to+ the text below for details about migrating to another password type.+ </para>+ </warning>
</listitem>
</varlistentry>
diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgmlindex 9707d5238d..f6484f0210 100644--- a/doc/src/sgml/config.sgml+++ b/doc/src/sgml/config.sgml@@ -1124,6 +1124,14 @@ include_dir 'conf.d'
mechanism, and hence not work with passwords encrypted with
SCRAM-SHA-256. See <xref linkend="auth-password"/> for more details.
</para>
+ <warning>+ <para>+ Support for MD5-encrypted passwords is deprecated and will be removed+ in a future release of <productname>PostgreSQL</productname>. Refer+ to <xref linkend="auth-password"/> for details about migrating to+ another password type.+ </para>+ </warning>
</listitem>
</varlistentry>
diff --git a/doc/src/sgml/libpq.sgml b/doc/src/sgml/libpq.sgmlindex afc9346757..54a7bcf6bb 100644--- a/doc/src/sgml/libpq.sgml+++ b/doc/src/sgml/libpq.sgml@@ -1341,6 +1341,15 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname
<para>
The server must request MD5 hashed password authentication.
</para>
+ <warning>+ <para>+ Support for MD5-encrypted passwords is deprecated and will be+ removed in a future release of+ <productname>PostgreSQL</productname>. Refer to+ <xref linkend="auth-password"/> for details about migrating to+ another password type.+ </para>+ </warning>
</listitem>
</varlistentry>
diff --git a/doc/src/sgml/protocol.sgml b/doc/src/sgml/protocol.sgmlindex 057c46f3f5..b7ecee02c0 100644--- a/doc/src/sgml/protocol.sgml+++ b/doc/src/sgml/protocol.sgml@@ -312,6 +312,14 @@
(Keep in mind the <function>md5()</function> function returns its
result as a hex string.)
</para>
+ <warning>+ <para>+ Support for MD5-encrypted passwords is deprecated and will be removed+ in a future release of <productname>PostgreSQL</productname>. Refer+ to <xref linkend="auth-password"/> for details about migrating to+ another password type.+ </para>+ </warning>
</listitem>
</varlistentry>
diff --git a/doc/src/sgml/ref/create_role.sgml b/doc/src/sgml/ref/create_role.sgmlindex f72ba9affc..cee23b1ea6 100644--- a/doc/src/sgml/ref/create_role.sgml+++ b/doc/src/sgml/ref/create_role.sgml@@ -273,6 +273,14 @@ in sync when changing the above synopsis!
different format). This allows reloading of encrypted passwords
during dump/restore.
</para>
+ <warning>+ <para>+ Support for MD5-encrypted passwords is deprecated and will be removed+ in a future release of <productname>PostgreSQL</productname>. Refer+ to <xref linkend="auth-password"/> for details about migrating to+ another password type.+ </para>+ </warning>
</listitem>
</varlistentry>
diff --git a/doc/src/sgml/runtime.sgml b/doc/src/sgml/runtime.sgmlindex 2c4d5ef640..dac9eead0b 100644--- a/doc/src/sgml/runtime.sgml+++ b/doc/src/sgml/runtime.sgml@@ -2053,6 +2053,16 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
is an Internet standard and is more secure than the PostgreSQL-specific
MD5 authentication protocol.
</para>
++ <warning>+ <para>+ Support for MD5-encrypted passwords is deprecated and will be removed in+ a future release of <productname>PostgreSQL</productname>. Refer to+ <xref linkend="auth-password"/> for details about migrating to another+ password type.+ </para>+ </warning>+
</listitem>
</varlistentry>
diff --git a/src/backend/libpq/crypt.c b/src/backend/libpq/crypt.cindex b01525dc28..d37c70901b 100644--- a/src/backend/libpq/crypt.c+++ b/src/backend/libpq/crypt.c@@ -24,6 +24,8 @@
#include "utils/syscache.h"
#include "utils/timestamp.h"
+/* Enables deprecation warnings for MD5 passwords. */+bool md5_password_warnings = true;
/*
* Fetch stored password for a user, for authentication.
@@ -174,6 +176,14 @@ encrypt_password(PasswordType target_type, const char *role,
MAX_ENCRYPTED_PASSWORD_LEN)));
}
+ if (md5_password_warnings &&+ get_password_type(encrypted_password) == PASSWORD_TYPE_MD5)+ ereport(WARNING,+ (errcode(ERRCODE_WARNING_DEPRECATED_FEATURE),+ errmsg("setting an MD5-encrypted password"),+ errdetail("MD5 password support is deprecated and will be removed in a future release of PostgreSQL."),+ errhint("Refer to the PostgreSQL documentation for details about migrating to another password type.")));+
return encrypted_password;
}
diff --git a/src/backend/utils/misc/guc_tables.c b/src/backend/utils/misc/guc_tables.cindex 686309db58..4bdf214b31 100644--- a/src/backend/utils/misc/guc_tables.c+++ b/src/backend/utils/misc/guc_tables.c@@ -2076,6 +2076,15 @@ struct config_bool ConfigureNamesBool[] =
NULL, NULL, NULL
},
+ {+ {"md5_password_warnings", PGC_USERSET, CONN_AUTH_AUTH,+ gettext_noop("Enables deprecation warnings for MD5 passwords."),+ },+ &md5_password_warnings,+ true,+ NULL, NULL, NULL+ },+
/* End-of-list marker */
{
{NULL, 0, 0, NULL, NULL}, NULL, false, NULL, NULL, NULL
diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sampleindex 667e0dc40a..d1be17615c 100644--- a/src/backend/utils/misc/postgresql.conf.sample+++ b/src/backend/utils/misc/postgresql.conf.sample@@ -96,6 +96,7 @@
#authentication_timeout = 1min # 1s-600s
#password_encryption = scram-sha-256 # scram-sha-256 or md5
#scram_iterations = 4096
+#md5_password_warnings = on
# GSSAPI using Kerberos
#krb_server_keyfile = 'FILE:${sysconfdir}/krb5.keytab'
diff --git a/src/include/libpq/crypt.h b/src/include/libpq/crypt.hindex 0bb4400435..db7ea7bd1f 100644--- a/src/include/libpq/crypt.h+++ b/src/include/libpq/crypt.h@@ -25,6 +25,9 @@
*/
#define MAX_ENCRYPTED_PASSWORD_LEN (512)
+/* Enables deprecation warnings for MD5 passwords. */+extern PGDLLIMPORT bool md5_password_warnings;+
/*
* Types of password hashes or secrets.
*
diff --git a/src/test/modules/test_misc/t/003_check_guc.pl b/src/test/modules/test_misc/t/003_check_guc.plindex 3ae4bb1cd9..f4f2f1121a 100644--- a/src/test/modules/test_misc/t/003_check_guc.pl+++ b/src/test/modules/test_misc/t/003_check_guc.pl@@ -56,7 +56,7 @@ while (my $line = <$contents>)
# file.
# - Valid configuration options are followed immediately by " = ",
# with one space before and after the equal sign.
- if ($line =~ m/^#?([_[:alpha:]]+) = .*/)+ if ($line =~ m/^#?([_[:alnum:]]+) = .*/)
{
# Lower-case conversion matters for some of the GUCs.
my $param_name = lc($1);
diff --git a/src/test/regress/expected/password.out b/src/test/regress/expected/password.outindex df3857460c..9bb3ab2818 100644--- a/src/test/regress/expected/password.out+++ b/src/test/regress/expected/password.out@@ -14,8 +14,14 @@ SET password_encryption = 'scram-sha-256'; -- ok
SET password_encryption = 'md5';
CREATE ROLE regress_passwd1;
ALTER ROLE regress_passwd1 PASSWORD 'role_pwd1';
+WARNING: setting an MD5-encrypted password+DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.+HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
CREATE ROLE regress_passwd2;
ALTER ROLE regress_passwd2 PASSWORD 'role_pwd2';
+WARNING: setting an MD5-encrypted password+DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.+HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
SET password_encryption = 'scram-sha-256';
CREATE ROLE regress_passwd3 PASSWORD 'role_pwd3';
CREATE ROLE regress_passwd4 PASSWORD NULL;
@@ -57,14 +63,23 @@ ALTER ROLE regress_passwd2_new RENAME TO regress_passwd2;
SET password_encryption = 'md5';
-- encrypt with MD5
ALTER ROLE regress_passwd2 PASSWORD 'foo';
+WARNING: setting an MD5-encrypted password+DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.+HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
-- already encrypted, use as they are
ALTER ROLE regress_passwd1 PASSWORD 'md5cd3578025fe2c3d7ed1b9a9b26238b70';
+WARNING: setting an MD5-encrypted password+DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.+HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
ALTER ROLE regress_passwd3 PASSWORD 'SCRAM-SHA-256$4096:VLK4RMaQLCvNtQ==$6YtlR4t69SguDiwFvbVgVZtuz6gpJQQqUMZ7IQJK5yI=:ps75jrHeYU4lXCcXI4O8oIdJ3eO8o2jirjruw9phBTo=';
SET password_encryption = 'scram-sha-256';
-- create SCRAM secret
ALTER ROLE regress_passwd4 PASSWORD 'foo';
-- already encrypted with MD5, use as it is
CREATE ROLE regress_passwd5 PASSWORD 'md5e73a4b11df52a6068f8b39f90be36023';
+WARNING: setting an MD5-encrypted password+DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.+HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
-- This looks like a valid SCRAM-SHA-256 secret, but it is not
-- so it should be hashed with SCRAM-SHA-256.
CREATE ROLE regress_passwd6 PASSWORD 'SCRAM-SHA-256$1234';
diff --git a/src/test/regress/expected/password_1.out b/src/test/regress/expected/password_1.outindex bd0c2e48de..8f613e976a 100644--- a/src/test/regress/expected/password_1.out+++ b/src/test/regress/expected/password_1.out@@ -61,12 +61,18 @@ ALTER ROLE regress_passwd2 PASSWORD 'foo';
ERROR: password encryption failed: unsupported
-- already encrypted, use as they are
ALTER ROLE regress_passwd1 PASSWORD 'md5cd3578025fe2c3d7ed1b9a9b26238b70';
+WARNING: setting an MD5-encrypted password+DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.+HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
ALTER ROLE regress_passwd3 PASSWORD 'SCRAM-SHA-256$4096:VLK4RMaQLCvNtQ==$6YtlR4t69SguDiwFvbVgVZtuz6gpJQQqUMZ7IQJK5yI=:ps75jrHeYU4lXCcXI4O8oIdJ3eO8o2jirjruw9phBTo=';
SET password_encryption = 'scram-sha-256';
-- create SCRAM secret
ALTER ROLE regress_passwd4 PASSWORD 'foo';
-- already encrypted with MD5, use as it is
CREATE ROLE regress_passwd5 PASSWORD 'md5e73a4b11df52a6068f8b39f90be36023';
+WARNING: setting an MD5-encrypted password+DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.+HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
-- This looks like a valid SCRAM-SHA-256 secret, but it is not
-- so it should be hashed with SCRAM-SHA-256.
CREATE ROLE regress_passwd6 PASSWORD 'SCRAM-SHA-256$1234';
@@ -100,6 +106,9 @@ SELECT rolname, regexp_replace(rolpassword, '(SCRAM-SHA-256)\$(\d+):([a-zA-Z0-9+
CREATE ROLE regress_passwd_empty PASSWORD '';
NOTICE: empty string is not a valid password, clearing password
ALTER ROLE regress_passwd_empty PASSWORD 'md585939a5ce845f1a1b620742e3c659e0a';
+WARNING: setting an MD5-encrypted password+DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.+HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
ALTER ROLE regress_passwd_empty PASSWORD 'SCRAM-SHA-256$4096:hpFyHTUsSWcR7O9P$LgZFIt6Oqdo27ZFKbZ2nV+vtnYM995pDh9ca6WSi120=:qVV5NeluNfUPkwm7Vqat25RjSPLkGeoZBQs6wVv+um4=';
NOTICE: empty string is not a valid password, clearing password
SELECT rolpassword FROM pg_authid WHERE rolname='regress_passwd_empty';
--
2.39.5 (Apple Git-154)
Attachments:
[text/plain] v1-0001-Deprecate-MD5-passwords.patch (17.1K, ../ZwmaW2AeUjBJGHgw@nathan/2-v1-0001-Deprecate-MD5-passwords.patch)
download | inline diff:
From a20f43d93562c4234de228ae3f0afae12750d7a0 Mon Sep 17 00:00:00 2001
From: Nathan Bossart <nathan@postgresql.org>
Date: Fri, 11 Oct 2024 16:21:09 -0500
Subject: [PATCH v1 1/1] Deprecate MD5 passwords.
MD5 has been considered to be unsuitable for use as a cryptographic
hash algorithm for some time. Furthermore, MD5 password hashes in
PostgreSQL are vulnerable to pass-the-hash attacks, i.e., knowing
the username and hashed password is sufficient to authenticate.
The SCRAM-SHA-256 method added in v10 is not subject to these
problems and is considered to be superior to MD5.
This commit marks MD5 password support in PostgreSQL as deprecated
and to be removed in a future release. The documentation now
contains several deprecation notices, and CREATE ROLE and ALTER
ROLE now emit deprecation warnings when setting MD5 passwords. The
warnings can be disabled by setting the md5_password_warnings
parameter to "off".
Reviewed-by: ???
Discussion: https://postgr.es/m/ZwbfpJJol7lDWajL%40nathan
---
contrib/passwordcheck/expected/passwordcheck.out | 3 +++
.../passwordcheck/expected/passwordcheck_1.out | 6 ++++++
doc/src/sgml/catalogs.sgml | 9 +++++++++
doc/src/sgml/client-auth.sgml | 8 ++++++++
doc/src/sgml/config.sgml | 8 ++++++++
doc/src/sgml/libpq.sgml | 9 +++++++++
doc/src/sgml/protocol.sgml | 8 ++++++++
doc/src/sgml/ref/create_role.sgml | 8 ++++++++
doc/src/sgml/runtime.sgml | 10 ++++++++++
src/backend/libpq/crypt.c | 10 ++++++++++
src/backend/utils/misc/guc_tables.c | 9 +++++++++
src/backend/utils/misc/postgresql.conf.sample | 1 +
src/include/libpq/crypt.h | 3 +++
src/test/modules/test_misc/t/003_check_guc.pl | 2 +-
src/test/regress/expected/password.out | 15 +++++++++++++++
src/test/regress/expected/password_1.out | 9 +++++++++
16 files changed, 117 insertions(+), 1 deletion(-)
diff --git a/contrib/passwordcheck/expected/passwordcheck.out b/contrib/passwordcheck/expected/passwordcheck.outindex 2027681daf..2f91b53b8a 100644--- a/contrib/passwordcheck/expected/passwordcheck.out+++ b/contrib/passwordcheck/expected/passwordcheck.out@@ -13,6 +13,9 @@ ALTER USER regress_passwordcheck_user1 PASSWORD 'alessnicelongpassword';
ERROR: password must contain both letters and nonletters
-- encrypted ok (password is "secret")
ALTER USER regress_passwordcheck_user1 PASSWORD 'md592350e12ac34e52dd598f90893bb3ae7';
+WARNING: setting an MD5-encrypted password+DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.+HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
-- error: password is user name
ALTER USER regress_passwordcheck_user1 PASSWORD 'md507a112732ed9f2087fa90b192d44e358';
ERROR: password must not equal user name
diff --git a/contrib/passwordcheck/expected/passwordcheck_1.out b/contrib/passwordcheck/expected/passwordcheck_1.outindex 5d8d5dcc1c..ebb72956b0 100644--- a/contrib/passwordcheck/expected/passwordcheck_1.out+++ b/contrib/passwordcheck/expected/passwordcheck_1.out@@ -13,6 +13,12 @@ ALTER USER regress_passwordcheck_user1 PASSWORD 'alessnicelongpassword';
ERROR: password must contain both letters and nonletters
-- encrypted ok (password is "secret")
ALTER USER regress_passwordcheck_user1 PASSWORD 'md592350e12ac34e52dd598f90893bb3ae7';
+WARNING: setting an MD5-encrypted password+DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.+HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
-- error: password is user name
ALTER USER regress_passwordcheck_user1 PASSWORD 'md507a112732ed9f2087fa90b192d44e358';
+WARNING: setting an MD5-encrypted password+DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.+HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
DROP USER regress_passwordcheck_user1;
diff --git a/doc/src/sgml/catalogs.sgml b/doc/src/sgml/catalogs.sgmlindex 964c819a02..0b9ca087c8 100644--- a/doc/src/sgml/catalogs.sgml+++ b/doc/src/sgml/catalogs.sgml@@ -1618,6 +1618,15 @@
will store the md5 hash of <literal>xyzzyjoe</literal>.
</para>
+ <warning>+ <para>+ Support for MD5-encrypted passwords is deprecated and will be removed in a+ future release of <productname>PostgreSQL</productname>. Refer to+ <xref linkend="auth-password"/> for details about migrating to another+ password type.+ </para>+ </warning>+
<para>
If the password is encrypted with SCRAM-SHA-256, it has the format:
<synopsis>
diff --git a/doc/src/sgml/client-auth.sgml b/doc/src/sgml/client-auth.sgmlindex 51343de7ca..60a1d16288 100644--- a/doc/src/sgml/client-auth.sgml+++ b/doc/src/sgml/client-auth.sgml@@ -1260,6 +1260,14 @@ omicron bryanh guest1
server is encrypted for SCRAM (see below), then SCRAM-based
authentication will automatically be chosen instead.
</para>
++ <warning>+ <para>+ Support for MD5-encrypted passwords is deprecated and will be removed+ in a future release of <productname>PostgreSQL</productname>. Refer to+ the text below for details about migrating to another password type.+ </para>+ </warning>
</listitem>
</varlistentry>
diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgmlindex 9707d5238d..f6484f0210 100644--- a/doc/src/sgml/config.sgml+++ b/doc/src/sgml/config.sgml@@ -1124,6 +1124,14 @@ include_dir 'conf.d'
mechanism, and hence not work with passwords encrypted with
SCRAM-SHA-256. See <xref linkend="auth-password"/> for more details.
</para>
+ <warning>+ <para>+ Support for MD5-encrypted passwords is deprecated and will be removed+ in a future release of <productname>PostgreSQL</productname>. Refer+ to <xref linkend="auth-password"/> for details about migrating to+ another password type.+ </para>+ </warning>
</listitem>
</varlistentry>
diff --git a/doc/src/sgml/libpq.sgml b/doc/src/sgml/libpq.sgmlindex afc9346757..54a7bcf6bb 100644--- a/doc/src/sgml/libpq.sgml+++ b/doc/src/sgml/libpq.sgml@@ -1341,6 +1341,15 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname
<para>
The server must request MD5 hashed password authentication.
</para>
+ <warning>+ <para>+ Support for MD5-encrypted passwords is deprecated and will be+ removed in a future release of+ <productname>PostgreSQL</productname>. Refer to+ <xref linkend="auth-password"/> for details about migrating to+ another password type.+ </para>+ </warning>
</listitem>
</varlistentry>
diff --git a/doc/src/sgml/protocol.sgml b/doc/src/sgml/protocol.sgmlindex 057c46f3f5..b7ecee02c0 100644--- a/doc/src/sgml/protocol.sgml+++ b/doc/src/sgml/protocol.sgml@@ -312,6 +312,14 @@
(Keep in mind the <function>md5()</function> function returns its
result as a hex string.)
</para>
+ <warning>+ <para>+ Support for MD5-encrypted passwords is deprecated and will be removed+ in a future release of <productname>PostgreSQL</productname>. Refer+ to <xref linkend="auth-password"/> for details about migrating to+ another password type.+ </para>+ </warning>
</listitem>
</varlistentry>
diff --git a/doc/src/sgml/ref/create_role.sgml b/doc/src/sgml/ref/create_role.sgmlindex f72ba9affc..cee23b1ea6 100644--- a/doc/src/sgml/ref/create_role.sgml+++ b/doc/src/sgml/ref/create_role.sgml@@ -273,6 +273,14 @@ in sync when changing the above synopsis!
different format). This allows reloading of encrypted passwords
during dump/restore.
</para>
+ <warning>+ <para>+ Support for MD5-encrypted passwords is deprecated and will be removed+ in a future release of <productname>PostgreSQL</productname>. Refer+ to <xref linkend="auth-password"/> for details about migrating to+ another password type.+ </para>+ </warning>
</listitem>
</varlistentry>
diff --git a/doc/src/sgml/runtime.sgml b/doc/src/sgml/runtime.sgmlindex 2c4d5ef640..dac9eead0b 100644--- a/doc/src/sgml/runtime.sgml+++ b/doc/src/sgml/runtime.sgml@@ -2053,6 +2053,16 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
is an Internet standard and is more secure than the PostgreSQL-specific
MD5 authentication protocol.
</para>
++ <warning>+ <para>+ Support for MD5-encrypted passwords is deprecated and will be removed in+ a future release of <productname>PostgreSQL</productname>. Refer to+ <xref linkend="auth-password"/> for details about migrating to another+ password type.+ </para>+ </warning>+
</listitem>
</varlistentry>
diff --git a/src/backend/libpq/crypt.c b/src/backend/libpq/crypt.cindex b01525dc28..d37c70901b 100644--- a/src/backend/libpq/crypt.c+++ b/src/backend/libpq/crypt.c@@ -24,6 +24,8 @@
#include "utils/syscache.h"
#include "utils/timestamp.h"
+/* Enables deprecation warnings for MD5 passwords. */+bool md5_password_warnings = true;
/*
* Fetch stored password for a user, for authentication.
@@ -174,6 +176,14 @@ encrypt_password(PasswordType target_type, const char *role,
MAX_ENCRYPTED_PASSWORD_LEN)));
}
+ if (md5_password_warnings &&+ get_password_type(encrypted_password) == PASSWORD_TYPE_MD5)+ ereport(WARNING,+ (errcode(ERRCODE_WARNING_DEPRECATED_FEATURE),+ errmsg("setting an MD5-encrypted password"),+ errdetail("MD5 password support is deprecated and will be removed in a future release of PostgreSQL."),+ errhint("Refer to the PostgreSQL documentation for details about migrating to another password type.")));+
return encrypted_password;
}
diff --git a/src/backend/utils/misc/guc_tables.c b/src/backend/utils/misc/guc_tables.cindex 686309db58..4bdf214b31 100644--- a/src/backend/utils/misc/guc_tables.c+++ b/src/backend/utils/misc/guc_tables.c@@ -2076,6 +2076,15 @@ struct config_bool ConfigureNamesBool[] =
NULL, NULL, NULL
},
+ {+ {"md5_password_warnings", PGC_USERSET, CONN_AUTH_AUTH,+ gettext_noop("Enables deprecation warnings for MD5 passwords."),+ },+ &md5_password_warnings,+ true,+ NULL, NULL, NULL+ },+
/* End-of-list marker */
{
{NULL, 0, 0, NULL, NULL}, NULL, false, NULL, NULL, NULL
diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sampleindex 667e0dc40a..d1be17615c 100644--- a/src/backend/utils/misc/postgresql.conf.sample+++ b/src/backend/utils/misc/postgresql.conf.sample@@ -96,6 +96,7 @@
#authentication_timeout = 1min # 1s-600s
#password_encryption = scram-sha-256 # scram-sha-256 or md5
#scram_iterations = 4096
+#md5_password_warnings = on
# GSSAPI using Kerberos
#krb_server_keyfile = 'FILE:${sysconfdir}/krb5.keytab'
diff --git a/src/include/libpq/crypt.h b/src/include/libpq/crypt.hindex 0bb4400435..db7ea7bd1f 100644--- a/src/include/libpq/crypt.h+++ b/src/include/libpq/crypt.h@@ -25,6 +25,9 @@
*/
#define MAX_ENCRYPTED_PASSWORD_LEN (512)
+/* Enables deprecation warnings for MD5 passwords. */+extern PGDLLIMPORT bool md5_password_warnings;+
/*
* Types of password hashes or secrets.
*
diff --git a/src/test/modules/test_misc/t/003_check_guc.pl b/src/test/modules/test_misc/t/003_check_guc.plindex 3ae4bb1cd9..f4f2f1121a 100644--- a/src/test/modules/test_misc/t/003_check_guc.pl+++ b/src/test/modules/test_misc/t/003_check_guc.pl@@ -56,7 +56,7 @@ while (my $line = <$contents>)
# file.
# - Valid configuration options are followed immediately by " = ",
# with one space before and after the equal sign.
- if ($line =~ m/^#?([_[:alpha:]]+) = .*/)+ if ($line =~ m/^#?([_[:alnum:]]+) = .*/)
{
# Lower-case conversion matters for some of the GUCs.
my $param_name = lc($1);
diff --git a/src/test/regress/expected/password.out b/src/test/regress/expected/password.outindex df3857460c..9bb3ab2818 100644--- a/src/test/regress/expected/password.out+++ b/src/test/regress/expected/password.out@@ -14,8 +14,14 @@ SET password_encryption = 'scram-sha-256'; -- ok
SET password_encryption = 'md5';
CREATE ROLE regress_passwd1;
ALTER ROLE regress_passwd1 PASSWORD 'role_pwd1';
+WARNING: setting an MD5-encrypted password+DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.+HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
CREATE ROLE regress_passwd2;
ALTER ROLE regress_passwd2 PASSWORD 'role_pwd2';
+WARNING: setting an MD5-encrypted password+DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.+HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
SET password_encryption = 'scram-sha-256';
CREATE ROLE regress_passwd3 PASSWORD 'role_pwd3';
CREATE ROLE regress_passwd4 PASSWORD NULL;
@@ -57,14 +63,23 @@ ALTER ROLE regress_passwd2_new RENAME TO regress_passwd2;
SET password_encryption = 'md5';
-- encrypt with MD5
ALTER ROLE regress_passwd2 PASSWORD 'foo';
+WARNING: setting an MD5-encrypted password+DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.+HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
-- already encrypted, use as they are
ALTER ROLE regress_passwd1 PASSWORD 'md5cd3578025fe2c3d7ed1b9a9b26238b70';
+WARNING: setting an MD5-encrypted password+DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.+HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
ALTER ROLE regress_passwd3 PASSWORD 'SCRAM-SHA-256$4096:VLK4RMaQLCvNtQ==$6YtlR4t69SguDiwFvbVgVZtuz6gpJQQqUMZ7IQJK5yI=:ps75jrHeYU4lXCcXI4O8oIdJ3eO8o2jirjruw9phBTo=';
SET password_encryption = 'scram-sha-256';
-- create SCRAM secret
ALTER ROLE regress_passwd4 PASSWORD 'foo';
-- already encrypted with MD5, use as it is
CREATE ROLE regress_passwd5 PASSWORD 'md5e73a4b11df52a6068f8b39f90be36023';
+WARNING: setting an MD5-encrypted password+DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.+HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
-- This looks like a valid SCRAM-SHA-256 secret, but it is not
-- so it should be hashed with SCRAM-SHA-256.
CREATE ROLE regress_passwd6 PASSWORD 'SCRAM-SHA-256$1234';
diff --git a/src/test/regress/expected/password_1.out b/src/test/regress/expected/password_1.outindex bd0c2e48de..8f613e976a 100644--- a/src/test/regress/expected/password_1.out+++ b/src/test/regress/expected/password_1.out@@ -61,12 +61,18 @@ ALTER ROLE regress_passwd2 PASSWORD 'foo';
ERROR: password encryption failed: unsupported
-- already encrypted, use as they are
ALTER ROLE regress_passwd1 PASSWORD 'md5cd3578025fe2c3d7ed1b9a9b26238b70';
+WARNING: setting an MD5-encrypted password+DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.+HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
ALTER ROLE regress_passwd3 PASSWORD 'SCRAM-SHA-256$4096:VLK4RMaQLCvNtQ==$6YtlR4t69SguDiwFvbVgVZtuz6gpJQQqUMZ7IQJK5yI=:ps75jrHeYU4lXCcXI4O8oIdJ3eO8o2jirjruw9phBTo=';
SET password_encryption = 'scram-sha-256';
-- create SCRAM secret
ALTER ROLE regress_passwd4 PASSWORD 'foo';
-- already encrypted with MD5, use as it is
CREATE ROLE regress_passwd5 PASSWORD 'md5e73a4b11df52a6068f8b39f90be36023';
+WARNING: setting an MD5-encrypted password+DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.+HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
-- This looks like a valid SCRAM-SHA-256 secret, but it is not
-- so it should be hashed with SCRAM-SHA-256.
CREATE ROLE regress_passwd6 PASSWORD 'SCRAM-SHA-256$1234';
@@ -100,6 +106,9 @@ SELECT rolname, regexp_replace(rolpassword, '(SCRAM-SHA-256)\$(\d+):([a-zA-Z0-9+
CREATE ROLE regress_passwd_empty PASSWORD '';
NOTICE: empty string is not a valid password, clearing password
ALTER ROLE regress_passwd_empty PASSWORD 'md585939a5ce845f1a1b620742e3c659e0a';
+WARNING: setting an MD5-encrypted password+DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.+HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
ALTER ROLE regress_passwd_empty PASSWORD 'SCRAM-SHA-256$4096:hpFyHTUsSWcR7O9P$LgZFIt6Oqdo27ZFKbZ2nV+vtnYM995pDh9ca6WSi120=:qVV5NeluNfUPkwm7Vqat25RjSPLkGeoZBQs6wVv+um4=';
NOTICE: empty string is not a valid password, clearing password
SELECT rolpassword FROM pg_authid WHERE rolname='regress_passwd_empty';
--
2.39.5 (Apple Git-154)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: nathandbossart@gmail.com, andrew@dunslane.net, tgl@sss.pgh.pa.us, hlinnaka@iki.fi
Subject: Re: sunsetting md5 password support
In-Reply-To: <ZwmaW2AeUjBJGHgw@nathan>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox