Skip to content

Commit eb61136

Browse files
hlinnakahlinnaka
committed
Remove support for password_encryption='off' / 'plain'.
Storing passwords in plaintext hasn't been a good idea for a very long time, if ever. Now seems like a good time to finally forbid it, since we're messing with this in PostgreSQL 10 anyway. Remove the CREATE/ALTER USER UNENCRYPTED PASSSWORD 'foo' syntax, since storing passwords unencrypted is no longer supported. ENCRYPTED PASSWORD 'foo' is still accepted, but ENCRYPTED is now just a noise-word, it does the same as just PASSWORD 'foo'. Likewise, remove the --unencrypted option from createuser, but accept --encrypted as a no-op for backward compatibility. AFAICS, --encrypted was a no-op even before this patch, because createuser encrypted the password before sending it to the server even if --encrypted was not specified. It added the ENCRYPTED keyword to the SQL command, but since the password was already in encrypted form, it didn't make any difference. The documentation was not clear on whether that was intended or not, but it's moot now. Also, while password_encryption='on' is still accepted as an alias for 'md5', it is now marked as hidden, so that it is not listed as an accepted value in error hints, for example. That's not directly related to removing 'plain', but it seems better this way. Reviewed by Michael Paquier Discussion: https://www.postgresql.org/message-id/16e9b768-fd78-0b12-cfc1-7b6b7f238fde@iki.fi
1 parent 1f30295 commit eb61136

File tree

21 files changed

+177
-331
lines changed

21 files changed

+177
-331
lines changed

‎contrib/passwordcheck/passwordcheck.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,8 @@ extern void _PG_init(void);
3939
*
4040
* username: name of role being created or changed
4141
* password: new password (possibly already encrypted)
42-
* password_type: PASSWORD_TYPE_PLAINTEXT or PASSWORD_TYPE_MD5 (there
43-
* could be other encryption schemes in future)
42+
* password_type: PASSWORD_TYPE_* code, to indicate if the password is
43+
* in plaintext or encrypted form.
4444
* validuntil_time: password expiration time, as a timestamptz Datum
4545
* validuntil_null: true if password expiration time is NULL
4646
*

‎doc/src/sgml/config.sgml

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1188,14 +1188,16 @@ include_dir 'conf.d'
11881188
<listitem>
11891189
<para>
11901190
When a password is specified in <xref linkend="sql-createrole"> or
1191-
<xref linkend="sql-alterrole"> without writing either <literal>ENCRYPTED</>
1192-
or <literal>UNENCRYPTED</>, this parameter determines whether the
1193-
password is to be encrypted. The default value is <literal>md5</>, which
1194-
stores the password as an MD5 hash. Setting this to <literal>plain</> stores
1195-
it in plaintext. <literal>on</> and <literal>off</> are also accepted, as
1196-
aliases for <literal>md5</> and <literal>plain</>, respectively. Setting
1197-
this parameter to <literal>scram-sha-256</> will encrypt the password
1198-
with SCRAM-SHA-256.
1191+
<xref linkend="sql-alterrole">, this parameter determines the algorithm
1192+
to use to encrypt the password. The default value is <literal>md5</>,
1193+
which stores the password as an MD5 hash (<literal>on</> is also
1194+
accepted, as alias for <literal>md5</>). Setting this parameter to
1195+
<literal>scram-sha-256</> will encrypt the password with SCRAM-SHA-256.
1196+
</para>
1197+
<para>
1198+
Note that older clients might lack support for the SCRAM authentication
1199+
mechanism, and hence not work with passwords encrypted with
1200+
SCRAM-SHA-256.
11991201
</para>
12001202
</listitem>
12011203
</varlistentry>

‎doc/src/sgml/ref/alter_role.sgml

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ ALTER ROLE <replaceable class="PARAMETER">role_specification</replaceable> [ WIT
3333
| REPLICATION | NOREPLICATION
3434
| BYPASSRLS | NOBYPASSRLS
3535
| CONNECTION LIMIT <replaceable class="PARAMETER">connlimit</replaceable>
36-
| [ ENCRYPTED | UNENCRYPTED ] PASSWORD '<replaceable class="PARAMETER">password</replaceable>'
36+
| [ ENCRYPTED ] PASSWORD '<replaceable class="PARAMETER">password</replaceable>'
3737
| VALID UNTIL '<replaceable class="PARAMETER">timestamp</replaceable>'
3838

3939
ALTER ROLE <replaceable class="PARAMETER">name</replaceable> RENAME TO <replaceable>new_name</replaceable>
@@ -168,9 +168,7 @@ ALTER ROLE { <replaceable class="PARAMETER">role_specification</replaceable> | A
168168
<term><literal>BYPASSRLS</literal></term>
169169
<term><literal>NOBYPASSRLS</literal></term>
170170
<term><literal>CONNECTION LIMIT</literal> <replaceable class="parameter">connlimit</replaceable></term>
171-
<term><literal>PASSWORD</> <replaceable class="parameter">password</replaceable></term>
172-
<term><literal>ENCRYPTED</></term>
173-
<term><literal>UNENCRYPTED</></term>
171+
<term>[ <literal>ENCRYPTED</> ] <literal>PASSWORD</> <replaceable class="parameter">password</replaceable></term>
174172
<term><literal>VALID UNTIL</literal> '<replaceable class="parameter">timestamp</replaceable>'</term>
175173
<listitem>
176174
<para>

‎doc/src/sgml/ref/alter_user.sgml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ ALTER USER <replaceable class="PARAMETER">role_specification</replaceable> [ WIT
3333
| REPLICATION | NOREPLICATION
3434
| BYPASSRLS | NOBYPASSRLS
3535
| CONNECTION LIMIT <replaceable class="PARAMETER">connlimit</replaceable>
36-
| [ ENCRYPTED | UNENCRYPTED ] PASSWORD '<replaceable class="PARAMETER">password</replaceable>'
36+
| [ ENCRYPTED ] PASSWORD '<replaceable class="PARAMETER">password</replaceable>'
3737
| VALID UNTIL '<replaceable class="PARAMETER">timestamp</replaceable>'
3838

3939
ALTER USER <replaceable class="PARAMETER">name</replaceable> RENAME TO <replaceable>new_name</replaceable>

‎doc/src/sgml/ref/create_group.sgml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ CREATE GROUP <replaceable class="PARAMETER">name</replaceable> [ [ WITH ] <repla
3030
| CREATEROLE | NOCREATEROLE
3131
| INHERIT | NOINHERIT
3232
| LOGIN | NOLOGIN
33-
| [ ENCRYPTED | UNENCRYPTED ] PASSWORD '<replaceable class="PARAMETER">password</replaceable>'
33+
| [ ENCRYPTED ] PASSWORD '<replaceable class="PARAMETER">password</replaceable>'
3434
| VALID UNTIL '<replaceable class="PARAMETER">timestamp</replaceable>'
3535
| IN ROLE <replaceable class="PARAMETER">role_name</replaceable> [, ...]
3636
| IN GROUP <replaceable class="PARAMETER">role_name</replaceable> [, ...]

‎doc/src/sgml/ref/create_role.sgml

Lines changed: 11 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ CREATE ROLE <replaceable class="PARAMETER">name</replaceable> [ [ WITH ] <replac
3333
| REPLICATION | NOREPLICATION
3434
| BYPASSRLS | NOBYPASSRLS
3535
| CONNECTION LIMIT <replaceable class="PARAMETER">connlimit</replaceable>
36-
| [ ENCRYPTED | UNENCRYPTED ] PASSWORD '<replaceable class="PARAMETER">password</replaceable>'
36+
| [ ENCRYPTED ] PASSWORD '<replaceable class="PARAMETER">password</replaceable>'
3737
| VALID UNTIL '<replaceable class="PARAMETER">timestamp</replaceable>'
3838
| IN ROLE <replaceable class="PARAMETER">role_name</replaceable> [, ...]
3939
| IN GROUP <replaceable class="PARAMETER">role_name</replaceable> [, ...]
@@ -207,7 +207,7 @@ CREATE ROLE <replaceable class="PARAMETER">name</replaceable> [ [ WITH ] <replac
207207
</varlistentry>
208208

209209
<varlistentry>
210-
<term><literal>PASSWORD</> <replaceable class="parameter">password</replaceable></term>
210+
<term>[ <literal>ENCRYPTED</> ] <literal>PASSWORD</> <replaceable class="parameter">password</replaceable></term>
211211
<listitem>
212212
<para>
213213
Sets the role's password. (A password is only of use for
@@ -219,30 +219,18 @@ CREATE ROLE <replaceable class="PARAMETER">name</replaceable> [ [ WITH ] <replac
219219
user. A null password can optionally be written explicitly as
220220
<literal>PASSWORD NULL</literal>.
221221
</para>
222-
</listitem>
223-
</varlistentry>
224-
225-
<varlistentry>
226-
<term><literal>ENCRYPTED</></term>
227-
<term><literal>UNENCRYPTED</></term>
228-
<listitem>
229222
<para>
230-
These key words control whether the password is stored
231-
encrypted in the system catalogs. (If neither is specified,
232-
the default behavior is determined by the configuration
233-
parameter <xref linkend="guc-password-encryption">.) If the
234-
presented password string is already in MD5-encrypted or
235-
SCRAM-encrypted format, then it is stored encrypted as-is,
236-
regardless of whether <literal>ENCRYPTED</> or <literal>UNENCRYPTED</>
237-
is specified (since the system cannot decrypt the specified encrypted
238-
password string). This allows reloading of encrypted passwords
223+
The password is always stored encrypted in the system catalogs. The
224+
<literal>ENCRYPTED</> keyword has no effect, but is accepted for
225+
backwards compatibility. The method of encryption is determined
226+
by the configuration parameter <xref linkend="guc-password-encryption">.
227+
If the presented password string is already in MD5-encrypted or
228+
SCRAM-encrypted format, then it is stored as-is regardless of
229+
<varname>password_encryption</> (since the system cannot decrypt
230+
the specified encrypted password string, to encrypt it in a
231+
different format). This allows reloading of encrypted passwords
239232
during dump/restore.
240233
</para>
241-
242-
<para>
243-
Note that older clients might lack support for the SCRAM
244-
authentication mechanism.
245-
</para>
246234
</listitem>
247235
</varlistentry>
248236

‎doc/src/sgml/ref/create_user.sgml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ CREATE USER <replaceable class="PARAMETER">name</replaceable> [ [ WITH ] <replac
3333
| REPLICATION | NOREPLICATION
3434
| BYPASSRLS | NOBYPASSRLS
3535
| CONNECTION LIMIT <replaceable class="PARAMETER">connlimit</replaceable>
36-
| [ ENCRYPTED | UNENCRYPTED ] PASSWORD '<replaceable class="PARAMETER">password</replaceable>'
36+
| [ ENCRYPTED ] PASSWORD '<replaceable class="PARAMETER">password</replaceable>'
3737
| VALID UNTIL '<replaceable class="PARAMETER">timestamp</replaceable>'
3838
| IN ROLE <replaceable class="PARAMETER">role_name</replaceable> [, ...]
3939
| IN GROUP <replaceable class="PARAMETER">role_name</replaceable> [, ...]

‎doc/src/sgml/ref/createuser.sgml

Lines changed: 3 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -124,8 +124,8 @@ PostgreSQL documentation
124124
<term><option>--encrypted</></term>
125125
<listitem>
126126
<para>
127-
Encrypts the user's password stored in the database. If not
128-
specified, the default password behavior is used.
127+
This option is obsolete but still accepted for backward
128+
compatibility.
129129
</para>
130130
</listitem>
131131
</varlistentry>
@@ -204,17 +204,6 @@ PostgreSQL documentation
204204
</listitem>
205205
</varlistentry>
206206

207-
<varlistentry>
208-
<term><option>-N</></term>
209-
<term><option>--unencrypted</></term>
210-
<listitem>
211-
<para>
212-
Does not encrypt the user's password stored in the database. If
213-
not specified, the default password behavior is used.
214-
</para>
215-
</listitem>
216-
</varlistentry>
217-
218207
<varlistentry>
219208
<term><option>-P</></term>
220209
<term><option>--pwprompt</></term>
@@ -481,11 +470,7 @@ PostgreSQL documentation
481470
</screen>
482471
In the above example, the new password isn't actually echoed when typed,
483472
but we show what was typed for clarity. As you see, the password is
484-
encrypted before it is sent to the client. If the option <option>--unencrypted</option>
485-
is used, the password <emphasis>will</> appear in the echoed command
486-
(and possibly also in the server log and elsewhere),
487-
so you don't want to use <option>-e</> in that case, if
488-
anyone else can see your screen.
473+
encrypted before it is sent to the client.
489474
</para>
490475
</refsect1>
491476

‎src/backend/commands/user.c

Lines changed: 6 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,6 @@ CreateRole(ParseState *pstate, CreateRoleStmt *stmt)
8080
ListCell *item;
8181
ListCell *option;
8282
char *password = NULL; /* user password */
83-
int password_type = Password_encryption;
8483
bool issuper = false; /* Make the user a superuser? */
8584
bool inherit = true; /* Auto inherit privileges? */
8685
bool createrole = false; /* Can this user create roles? */
@@ -128,25 +127,14 @@ CreateRole(ParseState *pstate, CreateRoleStmt *stmt)
128127
{
129128
DefElem *defel = (DefElem *) lfirst(option);
130129

131-
if (strcmp(defel->defname, "password") == 0 ||
132-
strcmp(defel->defname, "encryptedPassword") == 0 ||
133-
strcmp(defel->defname, "unencryptedPassword") == 0)
130+
if (strcmp(defel->defname, "password") == 0)
134131
{
135132
if (dpassword)
136133
ereport(ERROR,
137134
(errcode(ERRCODE_SYNTAX_ERROR),
138135
errmsg("conflicting or redundant options"),
139136
parser_errposition(pstate, defel->location)));
140137
dpassword = defel;
141-
if (strcmp(defel->defname, "encryptedPassword") == 0)
142-
{
143-
if (Password_encryption == PASSWORD_TYPE_SCRAM_SHA_256)
144-
password_type = PASSWORD_TYPE_SCRAM_SHA_256;
145-
else
146-
password_type = PASSWORD_TYPE_MD5;
147-
}
148-
else if (strcmp(defel->defname, "unencryptedPassword") == 0)
149-
password_type = PASSWORD_TYPE_PLAINTEXT;
150138
}
151139
else if (strcmp(defel->defname, "sysid") == 0)
152140
{
@@ -400,7 +388,8 @@ CreateRole(ParseState *pstate, CreateRoleStmt *stmt)
400388
/* Encrypt the password to the requested format. */
401389
char *shadow_pass;
402390

403-
shadow_pass = encrypt_password(password_type, stmt->role, password);
391+
shadow_pass = encrypt_password(Password_encryption, stmt->role,
392+
password);
404393
new_record[Anum_pg_authid_rolpassword - 1] =
405394
CStringGetTextDatum(shadow_pass);
406395
}
@@ -503,7 +492,6 @@ AlterRole(AlterRoleStmt *stmt)
503492
ListCell *option;
504493
char *rolename = NULL;
505494
char *password = NULL; /* user password */
506-
int password_type = Password_encryption;
507495
int issuper = -1; /* Make the user a superuser? */
508496
int inherit = -1; /* Auto inherit privileges? */
509497
int createrole = -1; /* Can this user create roles? */
@@ -537,24 +525,13 @@ AlterRole(AlterRoleStmt *stmt)
537525
{
538526
DefElem *defel = (DefElem *) lfirst(option);
539527

540-
if (strcmp(defel->defname, "password") == 0 ||
541-
strcmp(defel->defname, "encryptedPassword") == 0 ||
542-
strcmp(defel->defname, "unencryptedPassword") == 0)
528+
if (strcmp(defel->defname, "password") == 0)
543529
{
544530
if (dpassword)
545531
ereport(ERROR,
546532
(errcode(ERRCODE_SYNTAX_ERROR),
547533
errmsg("conflicting or redundant options")));
548534
dpassword = defel;
549-
if (strcmp(defel->defname, "encryptedPassword") == 0)
550-
{
551-
if (Password_encryption == PASSWORD_TYPE_SCRAM_SHA_256)
552-
password_type = PASSWORD_TYPE_SCRAM_SHA_256;
553-
else
554-
password_type = PASSWORD_TYPE_MD5;
555-
}
556-
else if (strcmp(defel->defname, "unencryptedPassword") == 0)
557-
password_type = PASSWORD_TYPE_PLAINTEXT;
558535
}
559536
else if (strcmp(defel->defname, "superuser") == 0)
560537
{
@@ -809,7 +786,8 @@ AlterRole(AlterRoleStmt *stmt)
809786
/* Encrypt the password to the requested format. */
810787
char *shadow_pass;
811788

812-
shadow_pass = encrypt_password(password_type, rolename, password);
789+
shadow_pass = encrypt_password(Password_encryption, rolename,
790+
password);
813791
new_record[Anum_pg_authid_rolpassword - 1] =
814792
CStringGetTextDatum(shadow_pass);
815793
new_record_repl[Anum_pg_authid_rolpassword - 1] = true;

‎src/backend/libpq/auth-scram.c

Lines changed: 2 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -199,27 +199,11 @@ pg_be_scram_init(const char *username, const char *shadow_pass)
199199
got_verifier = false;
200200
}
201201
}
202-
else if (password_type == PASSWORD_TYPE_PLAINTEXT)
203-
{
204-
/*
205-
* The stored password is in plain format. Generate a fresh SCRAM
206-
* verifier from it, and proceed with that.
207-
*/
208-
char *verifier;
209-
210-
verifier = pg_be_scram_build_verifier(shadow_pass);
211-
212-
(void) parse_scram_verifier(verifier, &state->iterations, &state->salt,
213-
state->StoredKey, state->ServerKey);
214-
pfree(verifier);
215-
216-
got_verifier = true;
217-
}
218202
else
219203
{
220204
/*
221-
* The user doesn't have SCRAM verifier, nor could we generate
222-
* one. (You cannot do SCRAM authentication with an MD5 hash.)
205+
* The user doesn't have SCRAM verifier. (You cannot do SCRAM
206+
* authentication with an MD5 hash.)
223207
*/
224208
state->logdetail = psprintf(_("User \"%s\" does not have a valid SCRAM verifier."),
225209
state->username);

‎src/backend/libpq/auth.c

Lines changed: 8 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -754,17 +754,13 @@ CheckPWChallengeAuth(Port *port, char **logdetail)
754754
shadow_pass = get_role_password(port->user_name, logdetail);
755755

756756
/*
757-
* If the user does not exist, or has no password, we still go through the
758-
* motions of authentication, to avoid revealing to the client that the
759-
* user didn't exist. If 'md5' is allowed, we choose whether to use 'md5'
760-
* or 'scram-sha-256' authentication based on current password_encryption
761-
* setting. The idea is that most genuine users probably have a password
762-
* of that type, if we pretend that this user had a password of that type,
763-
* too, it "blends in" best.
764-
*
765-
* If the user had a password, but it was expired, we'll use the details
766-
* of the expired password for the authentication, but report it as
767-
* failure to the client even if correct password was given.
757+
* If the user does not exist, or has no password or it's expired, we
758+
* still go through the motions of authentication, to avoid revealing to
759+
* the client that the user didn't exist. If 'md5' is allowed, we choose
760+
* whether to use 'md5' or 'scram-sha-256' authentication based on
761+
* current password_encryption setting. The idea is that most genuine
762+
* users probably have a password of that type, and if we pretend that
763+
* this user had a password of that type, too, it "blends in" best.
768764
*/
769765
if (!shadow_pass)
770766
pwtype = Password_encryption;
@@ -775,21 +771,15 @@ CheckPWChallengeAuth(Port *port, char **logdetail)
775771
* If 'md5' authentication is allowed, decide whether to perform 'md5' or
776772
* 'scram-sha-256' authentication based on the type of password the user
777773
* has. If it's an MD5 hash, we must do MD5 authentication, and if it's
778-
* a SCRAM verifier, we must do SCRAM authentication. If it's stored in
779-
* plaintext, we could do either one, so we opt for the more secure
780-
* mechanism, SCRAM.
774+
* a SCRAM verifier, we must do SCRAM authentication.
781775
*
782776
* If MD5 authentication is not allowed, always use SCRAM. If the user
783777
* had an MD5 password, CheckSCRAMAuth() will fail.
784778
*/
785779
if (port->hba->auth_method == uaMD5 && pwtype == PASSWORD_TYPE_MD5)
786-
{
787780
auth_result = CheckMD5Auth(port, shadow_pass, logdetail);
788-
}
789781
else
790-
{
791782
auth_result = CheckSCRAMAuth(port, shadow_pass, logdetail);
792-
}
793783

794784
if (shadow_pass)
795785
pfree(shadow_pass);

0 commit comments

Comments
 (0)