Skip to content

Commit db6a4a9

Browse files
nathan-bossartnathan-bossart
committed
Deprecate MD5 passwords.
MD5 has been considered to be unsuitable for use as a cryptographic hash algorithm for some time. Furthermore, MD5 password hashes in PostgreSQL are vulnerable to pass-the-hash attacks, i.e., knowing the username and hashed password is sufficient to authenticate. The SCRAM-SHA-256 method added in v10 is not subject to these problems and is considered to be superior to MD5. This commit marks MD5 password support in PostgreSQL as deprecated and to be removed in a future release. The documentation now contains several deprecation notices, and CREATE ROLE and ALTER ROLE now emit deprecation warnings when setting MD5 passwords. The warnings can be disabled by setting the md5_password_warnings parameter to "off". Reviewed-by: Greg Sabino Mullane, Jim Nasby Discussion: https://postgr.es/m/ZwbfpJJol7lDWajL%40nathan
1 parent 9717353 commit db6a4a9

File tree

16 files changed

+135
-0
lines changed

16 files changed

+135
-0
lines changed

‎contrib/passwordcheck/expected/passwordcheck.out

+1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
SET md5_password_warnings = off;
12
LOAD 'passwordcheck';
23
CREATE USER regress_passwordcheck_user1;
34
-- ok

‎contrib/passwordcheck/expected/passwordcheck_1.out

+1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
SET md5_password_warnings = off;
12
LOAD 'passwordcheck';
23
CREATE USER regress_passwordcheck_user1;
34
-- ok

‎contrib/passwordcheck/sql/passwordcheck.sql

+1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
SET md5_password_warnings = off;
12
LOAD 'passwordcheck';
23

34
CREATE USER regress_passwordcheck_user1;

‎doc/src/sgml/catalogs.sgml

+9
Original file line numberDiff line numberDiff line change
@@ -1618,6 +1618,15 @@
16181618
will store the md5 hash of <literal>xyzzyjoe</literal>.
16191619
</para>
16201620

1621+
<warning>
1622+
<para>
1623+
Support for MD5-encrypted passwords is deprecated and will be removed in a
1624+
future release of <productname>PostgreSQL</productname>. Refer to
1625+
<xref linkend="auth-password"/> for details about migrating to another
1626+
password type.
1627+
</para>
1628+
</warning>
1629+
16211630
<para>
16221631
If the password is encrypted with SCRAM-SHA-256, it has the format:
16231632
<synopsis>

‎doc/src/sgml/client-auth.sgml

+17
Original file line numberDiff line numberDiff line change
@@ -531,6 +531,15 @@ include_dir <replaceable>directory</replaceable>
531531
user's password. See <xref linkend="auth-password"/>
532532
for details.
533533
</para>
534+
<warning>
535+
<para>
536+
Support for MD5-encrypted passwords is deprecated and will be
537+
removed in a future release of
538+
<productname>PostgreSQL</productname>. Refer to
539+
<xref linkend="auth-password"/> for details about migrating to
540+
another password type.
541+
</para>
542+
</warning>
534543
</listitem>
535544
</varlistentry>
536545

@@ -1260,6 +1269,14 @@ omicron bryanh guest1
12601269
server is encrypted for SCRAM (see below), then SCRAM-based
12611270
authentication will automatically be chosen instead.
12621271
</para>
1272+
1273+
<warning>
1274+
<para>
1275+
Support for MD5-encrypted passwords is deprecated and will be removed
1276+
in a future release of <productname>PostgreSQL</productname>. Refer to
1277+
the text below for details about migrating to another password type.
1278+
</para>
1279+
</warning>
12631280
</listitem>
12641281
</varlistentry>
12651282

‎doc/src/sgml/config.sgml

+24
Original file line numberDiff line numberDiff line change
@@ -1124,6 +1124,14 @@ include_dir 'conf.d'
11241124
mechanism, and hence not work with passwords encrypted with
11251125
SCRAM-SHA-256. See <xref linkend="auth-password"/> for more details.
11261126
</para>
1127+
<warning>
1128+
<para>
1129+
Support for MD5-encrypted passwords is deprecated and will be removed
1130+
in a future release of <productname>PostgreSQL</productname>. Refer
1131+
to <xref linkend="auth-password"/> for details about migrating to
1132+
another password type.
1133+
</para>
1134+
</warning>
11271135
</listitem>
11281136
</varlistentry>
11291137

@@ -7913,6 +7921,22 @@ log_line_prefix = '%m [%p] %q%u@%d/%a '
79137921
</listitem>
79147922
</varlistentry>
79157923

7924+
<varlistentry id="guc-md5-password-warnings" xreflabel="md5_password_warnings">
7925+
<term><varname>md5_password_warnings</varname> (<type>boolean</type>)
7926+
<indexterm>
7927+
<primary><varname>md5_password_warnings</varname> configuration parameter</primary>
7928+
</indexterm>
7929+
</term>
7930+
<listitem>
7931+
<para>
7932+
Controls whether a <literal>WARNING</literal> about MD5 password
7933+
deprecation is produced when a <command>CREATE ROLE</command> or
7934+
<command>ALTER ROLE</command> statement sets an MD5-encrypted password.
7935+
The default value is <literal>on</literal>.
7936+
</para>
7937+
</listitem>
7938+
</varlistentry>
7939+
79167940
</variablelist>
79177941
</sect2>
79187942
<sect2 id="runtime-config-logging-csvlog">

‎doc/src/sgml/libpq.sgml

+9
Original file line numberDiff line numberDiff line change
@@ -1341,6 +1341,15 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname
13411341
<para>
13421342
The server must request MD5 hashed password authentication.
13431343
</para>
1344+
<warning>
1345+
<para>
1346+
Support for MD5-encrypted passwords is deprecated and will be
1347+
removed in a future release of
1348+
<productname>PostgreSQL</productname>. Refer to
1349+
<xref linkend="auth-password"/> for details about migrating to
1350+
another password type.
1351+
</para>
1352+
</warning>
13441353
</listitem>
13451354
</varlistentry>
13461355

‎doc/src/sgml/protocol.sgml

+8
Original file line numberDiff line numberDiff line change
@@ -312,6 +312,14 @@
312312
(Keep in mind the <function>md5()</function> function returns its
313313
result as a hex string.)
314314
</para>
315+
<warning>
316+
<para>
317+
Support for MD5-encrypted passwords is deprecated and will be removed
318+
in a future release of <productname>PostgreSQL</productname>. Refer
319+
to <xref linkend="auth-password"/> for details about migrating to
320+
another password type.
321+
</para>
322+
</warning>
315323
</listitem>
316324
</varlistentry>
317325

‎doc/src/sgml/ref/create_role.sgml

+8
Original file line numberDiff line numberDiff line change
@@ -273,6 +273,14 @@ in sync when changing the above synopsis!
273273
different format). This allows reloading of encrypted passwords
274274
during dump/restore.
275275
</para>
276+
<warning>
277+
<para>
278+
Support for MD5-encrypted passwords is deprecated and will be removed
279+
in a future release of <productname>PostgreSQL</productname>. Refer
280+
to <xref linkend="auth-password"/> for details about migrating to
281+
another password type.
282+
</para>
283+
</warning>
276284
</listitem>
277285
</varlistentry>
278286

‎doc/src/sgml/runtime.sgml

+10
Original file line numberDiff line numberDiff line change
@@ -2053,6 +2053,16 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
20532053
is an Internet standard and is more secure than the PostgreSQL-specific
20542054
MD5 authentication protocol.
20552055
</para>
2056+
2057+
<warning>
2058+
<para>
2059+
Support for MD5-encrypted passwords is deprecated and will be removed in
2060+
a future release of <productname>PostgreSQL</productname>. Refer to
2061+
<xref linkend="auth-password"/> for details about migrating to another
2062+
password type.
2063+
</para>
2064+
</warning>
2065+
20562066
</listitem>
20572067
</varlistentry>
20582068

‎src/backend/libpq/crypt.c

+10
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@
2424
#include "utils/syscache.h"
2525
#include "utils/timestamp.h"
2626

27+
/* Enables deprecation warnings for MD5 passwords. */
28+
bool md5_password_warnings = true;
2729

2830
/*
2931
* Fetch stored password for a user, for authentication.
@@ -174,6 +176,14 @@ encrypt_password(PasswordType target_type, const char *role,
174176
MAX_ENCRYPTED_PASSWORD_LEN)));
175177
}
176178

179+
if (md5_password_warnings &&
180+
get_password_type(encrypted_password) == PASSWORD_TYPE_MD5)
181+
ereport(WARNING,
182+
(errcode(ERRCODE_WARNING_DEPRECATED_FEATURE),
183+
errmsg("setting an MD5-encrypted password"),
184+
errdetail("MD5 password support is deprecated and will be removed in a future release of PostgreSQL."),
185+
errhint("Refer to the PostgreSQL documentation for details about migrating to another password type.")));
186+
177187
return encrypted_password;
178188
}
179189

‎src/backend/utils/misc/guc_tables.c

+9
Original file line numberDiff line numberDiff line change
@@ -2086,6 +2086,15 @@ struct config_bool ConfigureNamesBool[] =
20862086
NULL, NULL, NULL
20872087
},
20882088

2089+
{
2090+
{"md5_password_warnings", PGC_USERSET, CONN_AUTH_AUTH,
2091+
gettext_noop("Enables deprecation warnings for MD5 passwords."),
2092+
},
2093+
&md5_password_warnings,
2094+
true,
2095+
NULL, NULL, NULL
2096+
},
2097+
20892098
/* End-of-list marker */
20902099
{
20912100
{NULL, 0, 0, NULL, NULL}, NULL, false, NULL, NULL, NULL

‎src/backend/utils/misc/postgresql.conf.sample

+1
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,7 @@
9696
#authentication_timeout = 1min # 1s-600s
9797
#password_encryption = scram-sha-256 # scram-sha-256 or md5
9898
#scram_iterations = 4096
99+
#md5_password_warnings = on
99100

100101
# GSSAPI using Kerberos
101102
#krb_server_keyfile = 'FILE:${sysconfdir}/krb5.keytab'

‎src/include/libpq/crypt.h

+3
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,9 @@
2525
*/
2626
#define MAX_ENCRYPTED_PASSWORD_LEN (512)
2727

28+
/* Enables deprecation warnings for MD5 passwords. */
29+
extern PGDLLIMPORT bool md5_password_warnings;
30+
2831
/*
2932
* Types of password hashes or secrets.
3033
*

‎src/test/regress/expected/password.out

+15
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,14 @@ SET password_encryption = 'scram-sha-256'; -- ok
1414
SET password_encryption = 'md5';
1515
CREATE ROLE regress_passwd1;
1616
ALTER ROLE regress_passwd1 PASSWORD 'role_pwd1';
17+
WARNING: setting an MD5-encrypted password
18+
DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.
19+
HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
1720
CREATE ROLE regress_passwd2;
1821
ALTER ROLE regress_passwd2 PASSWORD 'role_pwd2';
22+
WARNING: setting an MD5-encrypted password
23+
DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.
24+
HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
1925
SET password_encryption = 'scram-sha-256';
2026
CREATE ROLE regress_passwd3 PASSWORD 'role_pwd3';
2127
CREATE ROLE regress_passwd4 PASSWORD NULL;
@@ -57,14 +63,23 @@ ALTER ROLE regress_passwd2_new RENAME TO regress_passwd2;
5763
SET password_encryption = 'md5';
5864
-- encrypt with MD5
5965
ALTER ROLE regress_passwd2 PASSWORD 'foo';
66+
WARNING: setting an MD5-encrypted password
67+
DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.
68+
HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
6069
-- already encrypted, use as they are
6170
ALTER ROLE regress_passwd1 PASSWORD 'md5cd3578025fe2c3d7ed1b9a9b26238b70';
71+
WARNING: setting an MD5-encrypted password
72+
DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.
73+
HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
6274
ALTER ROLE regress_passwd3 PASSWORD 'SCRAM-SHA-256$4096:VLK4RMaQLCvNtQ==$6YtlR4t69SguDiwFvbVgVZtuz6gpJQQqUMZ7IQJK5yI=:ps75jrHeYU4lXCcXI4O8oIdJ3eO8o2jirjruw9phBTo=';
6375
SET password_encryption = 'scram-sha-256';
6476
-- create SCRAM secret
6577
ALTER ROLE regress_passwd4 PASSWORD 'foo';
6678
-- already encrypted with MD5, use as it is
6779
CREATE ROLE regress_passwd5 PASSWORD 'md5e73a4b11df52a6068f8b39f90be36023';
80+
WARNING: setting an MD5-encrypted password
81+
DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.
82+
HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
6883
-- This looks like a valid SCRAM-SHA-256 secret, but it is not
6984
-- so it should be hashed with SCRAM-SHA-256.
7085
CREATE ROLE regress_passwd6 PASSWORD 'SCRAM-SHA-256$1234';

‎src/test/regress/expected/password_1.out

+9
Original file line numberDiff line numberDiff line change
@@ -61,12 +61,18 @@ ALTER ROLE regress_passwd2 PASSWORD 'foo';
6161
ERROR: password encryption failed: unsupported
6262
-- already encrypted, use as they are
6363
ALTER ROLE regress_passwd1 PASSWORD 'md5cd3578025fe2c3d7ed1b9a9b26238b70';
64+
WARNING: setting an MD5-encrypted password
65+
DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.
66+
HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
6467
ALTER ROLE regress_passwd3 PASSWORD 'SCRAM-SHA-256$4096:VLK4RMaQLCvNtQ==$6YtlR4t69SguDiwFvbVgVZtuz6gpJQQqUMZ7IQJK5yI=:ps75jrHeYU4lXCcXI4O8oIdJ3eO8o2jirjruw9phBTo=';
6568
SET password_encryption = 'scram-sha-256';
6669
-- create SCRAM secret
6770
ALTER ROLE regress_passwd4 PASSWORD 'foo';
6871
-- already encrypted with MD5, use as it is
6972
CREATE ROLE regress_passwd5 PASSWORD 'md5e73a4b11df52a6068f8b39f90be36023';
73+
WARNING: setting an MD5-encrypted password
74+
DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.
75+
HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
7076
-- This looks like a valid SCRAM-SHA-256 secret, but it is not
7177
-- so it should be hashed with SCRAM-SHA-256.
7278
CREATE ROLE regress_passwd6 PASSWORD 'SCRAM-SHA-256$1234';
@@ -100,6 +106,9 @@ SELECT rolname, regexp_replace(rolpassword, '(SCRAM-SHA-256)\$(\d+):([a-zA-Z0-9+
100106
CREATE ROLE regress_passwd_empty PASSWORD '';
101107
NOTICE: empty string is not a valid password, clearing password
102108
ALTER ROLE regress_passwd_empty PASSWORD 'md585939a5ce845f1a1b620742e3c659e0a';
109+
WARNING: setting an MD5-encrypted password
110+
DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.
111+
HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
103112
ALTER ROLE regress_passwd_empty PASSWORD 'SCRAM-SHA-256$4096:hpFyHTUsSWcR7O9P$LgZFIt6Oqdo27ZFKbZ2nV+vtnYM995pDh9ca6WSi120=:qVV5NeluNfUPkwm7Vqat25RjSPLkGeoZBQs6wVv+um4=';
104113
NOTICE: empty string is not a valid password, clearing password
105114
SELECT rolpassword FROM pg_authid WHERE rolname='regress_passwd_empty';

0 commit comments

Comments
 (0)