Date: Thu, 28 May 2020 18:52:05 +0200
From: Christoph Berg <myon@debian.org>
To: Stephen Frost <sfrost@snowman.net>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
	Devrim =?iso-8859-1?B?R/xuZPx6?= <devrim@gunduz.org>,
	Craig Ringer <craig@2ndquadrant.com>,
	pgsql-pkg-yum <pgsql-pkg-yum@postgresql.org>
Subject: Re: Can we stop defaulting to 'md5'?
Message-ID: <20200528165205.GC107313@msg.df7cb.de>
Mail-Followup-To: Christoph Berg <myon@debian.org>,
	Stephen Frost <sfrost@snowman.net>,
	Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
	Devrim =?iso-8859-1?B?R/xuZPx6?= <devrim@gunduz.org>,
	Craig Ringer <craig@2ndquadrant.com>,
	pgsql-pkg-yum <pgsql-pkg-yum@postgresql.org>
References: <20200520163509.GG3418@tamriel.snowman.net>
 <20200520153337.GE3418@tamriel.snowman.net>
 <20200528163856.GB107313@msg.df7cb.de>
 <20200528164404.GA6680@tamriel.snowman.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20200528164404.GA6680@tamriel.snowman.net>
Precedence: bulk

Re: Stephen Frost
> > Why do I have to decide *in pg_hba.conf* which hash algorithm is used?
> 
> Where else would you decide..?

Connections could just use whatever hash is used for the username in
pg_authid. There's no reason to expose that detail in pg_hba.conf.

> > Why can't that just be "password"?
> 
> What would that mean?

The above.

> > Getting this mess fixed would be good for security because then people
> > will likely start using scram.
> 
> That's certainly true, though I hope we can convince people to use SCRAM
> even given the modest effort required.

It's not modest. Or else this thread wouldn't have 20 mails.

> The point here though, really, is that *new* installations of PG have
> very little reason to not use SCRAM.  The question on upgrades is
> different, but that can be addressed with pg_upgradecluster, I would
> think, without much trouble.

In pg_createcluster, if I move pg_hba.conf and password_encryption to
scram, and I restore a dump from an older PG major, can people
continue to connect using their passwords? From what I got above, the
answer is "no".

Should I only set password_encryption to scram and keep advertising
md5 as the sane default for pg_hba.conf?

Christoph