From: Adrian Vogelsgesang <avogelsgesang@tableau.com>
To: "pgsql-interfaces@lists.postgresql.org"
	<pgsql-interfaces@lists.postgresql.org>
Subject: Libpq: Fail connection attempt if server didn't request a password
Thread-Topic: Libpq: Fail connection attempt if server didn't request a
 password
Thread-Index: AQHW62QrYUUy5tgLvUK8TVXQFX7sVw==
Date: Fri, 15 Jan 2021 17:56:54 +0000
Message-ID: 
 <BY5PR03MB4965271A9AE58B7367D1DB52A3A70@BY5PR03MB4965.namprd03.prod.outlook.com>
Accept-Language: en-US
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 
 c94303f1-dc77-4de4-ffff-08d8b97ef1cd
X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Jan 2021 17:56:54.5657
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 5067385a-c584-42cc-8679-3fa2879f99be
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 
 05aWunjjqr7CtruaVP80OLa26p6qEa+KQdStWn70I67vTGJypdO5OdM/b59K7rRk5ObhsV+UvadLmHxGCRALjByC3ZPk4C20jLAaJeINXXo=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR03MB4550
Authentication-Results: relay.mimecast.com;
	auth=pass smtp.auth=CUSA80A147 smtp.mailfrom=avogelsgesang@tableau.com
X-Mimecast-Spam-Score: 0
X-Mimecast-Originator: tableau.com
Content-Language: en-US
Content-Type: multipart/alternative;
	boundary="_000_BY5PR03MB4965271A9AE58B7367D1DB52A3A70BY5PR03MB4965namp_"
List-Id: <pgsql-interfaces.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-interfaces@lists.postgresql.org>
List-Owner: <mailto:pgsql-interfaces-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-interfaces>
Precedence: bulk

--_000_BY5PR03MB4965271A9AE58B7367D1DB52A3A70BY5PR03MB4965namp_
Content-Type: text/plain; charset=WINDOWS-1252
Content-Transfer-Encoding: quoted-printable

Dear Postgres community,

Today, I learned that in the Postgres protocol, the Postgres server first h=
as to request a password from the client before libpq will send it.
In particular, this also means: if the server doesn=92t request a password =
but simply accepts the connection, libpq will just establish the connection=
.

Is there some way to let libpq fail the connection attempt in such a case, =
i.e. if a password was provided but not requested from the server?
Can I, as the client, force the authentication used during creating a conne=
ction to be scram-sha-256?
Or can I at least disable MD5 and plain-text authentication on the client-s=
ide (which I both consider unsecure)?

You might ask: Why do I care to enforce the authentication mode on the clie=
nt side? Two reasons:
1. To identify misconfigured server. In our use case, all servers should re=
quire a password. By failing hard and early, we can more easily find miscon=
figured servers
2. To establish some trust on the client-side that I am actually connected =
to the correct server. In scram-sha-256, the server also has to authenticat=
e to the client. This would be a nice additional level of security. However=
, this is worthless if the client doesn=92t enforce a scram-sha-256 authent=
ication: A malicious server could simply accept the connection without aski=
ng for a password or use the MD5 method instead

Cheers,
Adrian

--_000_BY5PR03MB4965271A9AE58B7367D1DB52A3A70BY5PR03MB4965namp_
Content-Type: text/html; charset=WINDOWS-1252
Content-Transfer-Encoding: quoted-printable

<html xmlns:o=3D"urn:schemas-microsoft-com:office:office" xmlns:w=3D"urn:sc=
hemas-microsoft-com:office:word" xmlns:m=3D"http://schemas.microsoft.com/of=
fice/2004/12/omml" xmlns=3D"http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1=
252">
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
=09{font-family:"Cambria Math";
=09panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
=09{font-family:Calibri;
=09panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
=09{margin:0cm;
=09font-size:11.0pt;
=09font-family:"Calibri",sans-serif;
=09mso-fareast-language:EN-US;}
span.EmailStyle17
=09{mso-style-type:personal-compose;
=09font-family:"Calibri",sans-serif;
=09color:windowtext;}
.MsoChpDefault
=09{mso-style-type:export-only;
=09mso-fareast-language:EN-US;}
@page WordSection1
=09{size:612.0pt 792.0pt;
=09margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
=09{page:WordSection1;}
--></style>
</head>
<body lang=3D"en-DE" link=3D"#0563C1" vlink=3D"#954F72" style=3D"word-wrap:=
break-word">
<div class=3D"WordSection1">
<p class=3D"MsoNormal"><span lang=3D"EN-US">Dear Postgres community,<br>
<br>
Today, I learned that in the Postgres protocol, the Postgres server first h=
as to request a password from the client before libpq will send it.<br>
In particular, this also means: if the server doesn=92t request a password =
but simply accepts the connection, libpq will just establish the connection=
.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><br>
Is there some way to let libpq fail the connection attempt in such a case, =
i.e. if a password was provided but not requested from the server?<br>
Can I, as the client, force the authentication used during creating a conne=
ction to be scram-sha-256?<br>
Or can I at least disable MD5 and plain-text authentication on the client-s=
ide (which I both consider unsecure)?<br>
<br>
You might ask: Why do I care to enforce the authentication mode on the clie=
nt side? Two reasons:<br>
1. To identify misconfigured server. In our use case, all servers should re=
quire a password. By failing hard and early, we can more easily find miscon=
figured servers<br>
2. To establish some trust on the client-side that I am actually connected =
to the correct server. In scram-sha-256, the server also has to authenticat=
e to the client. This would be a nice additional level of security. However=
, this is worthless if the client
 doesn=92t enforce a scram-sha-256 authentication: A malicious server could=
 simply accept the connection without asking for a password or use the MD5 =
method instead<br>
<br>
Cheers,<br>
Adrian<o:p></o:p></span></p>
</div>
</body>
</html>

--_000_BY5PR03MB4965271A9AE58B7367D1DB52A3A70BY5PR03MB4965namp_--