Date: Thu, 28 May 2020 18:38:56 +0200
From: Christoph Berg <myon@debian.org>
To: Stephen Frost <sfrost@snowman.net>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
	Devrim =?iso-8859-1?B?R/xuZPx6?= <devrim@gunduz.org>,
	Craig Ringer <craig@2ndquadrant.com>,
	pgsql-pkg-yum <pgsql-pkg-yum@postgresql.org>
Subject: Re: Can we stop defaulting to 'md5'?
Message-ID: <20200528163856.GB107313@msg.df7cb.de>
Mail-Followup-To: Christoph Berg <myon@debian.org>,
	Stephen Frost <sfrost@snowman.net>,
	Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
	Devrim =?iso-8859-1?B?R/xuZPx6?= <devrim@gunduz.org>,
	Craig Ringer <craig@2ndquadrant.com>,
	pgsql-pkg-yum <pgsql-pkg-yum@postgresql.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20200520163509.GG3418@tamriel.snowman.net>
 <20200520153337.GE3418@tamriel.snowman.net>
Precedence: bulk

Re: Stephen Frost
> postgresql.conf alone, but ultimately that's probably going to be up to
> what Christoph is comfortable with.

Re: Stephen Frost
> If you leave it as 'md5' in pg_hba.conf, then *that* will do either md5,
> or scram.  If you have 'scram-sha-256' in pg_hba.conf and only an 'md5'
> password then it breaks.

Fwiw "comfortable" and "it breaks" are the problem here. The whole
picture is so utterly complicated that I'm still scared from reading
the docs the first time around the time PG10 came about. In trainings
I'm still telling people that md5 is the accepted standard because
there's enough more interesting things to teach about PostgreSQL.

Why do I have to decide *in pg_hba.conf* which hash algorithm is used?
Why can't that just be "password"?

The password_encryption GUC should be the only place concerned with
that, and it should only be used for new passwords. Existing passwords
should just continue to work. *That* would allow seamless upgrades.

Getting this mess fixed would be good for security because then people
will likely start using scram.

Christoph