Change default of password_encryption to scram-sha-256

Also, the legacy values on/true/yes/1 for password_encryption that
mapped to md5 are removed.  The only valid values are now
scram-sha-256 and md5.

Reviewed-by: Jonathan S. Katz <jkatz@postgresql.org>
Discussion: https://www.postgresql.org/message-id/flat/d5b0ad33-7d94-bdd1-caac-43a1c782cab2%402ndquadrant.com

diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index aca8f73a50db78bbafe0932ccfdbe6b491a4020a..29088215603be40b07675543a4ec53ada9b73955 100644 (file)
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -1013,11 +1013,11 @@ include_dir 'conf.d'
       <listitem>
        <para>
         When a password is specified in <xref linkend="sql-createrole"/> or
-        <xref linkend="sql-alterrole"/>, this parameter determines the algorithm
-        to use to encrypt the password. The default value is <literal>md5</literal>,
-        which stores the password as an MD5 hash (<literal>on</literal> is also
-        accepted, as alias for <literal>md5</literal>). Setting this parameter to
-        <literal>scram-sha-256</literal> will encrypt the password with SCRAM-SHA-256.
+        <xref linkend="sql-alterrole"/>, this parameter determines the
+        algorithm to use to encrypt the password.  Possible values are
+        <literal>scram-sha-256</literal>, which will encrypt the password with
+        SCRAM-SHA-256, and <literal>md5</literal>, which stores the password
+        as an MD5 hash.  The default is <literal>scram-sha-256</literal>.
        </para>
        <para>
         Note that older clients might lack support for the SCRAM authentication

diff --git a/src/backend/commands/user.c b/src/backend/commands/user.c
index 1ef00d6e89513e6db0b09466c5b597d3b1dfb4ec..9ce9a66921845b56aeb76e8bcebc16f62aa72da3 100644 (file)
--- a/src/backend/commands/user.c
+++ b/src/backend/commands/user.c
@@ -43,7 +43,7 @@ Oid           binary_upgrade_next_pg_authid_oid = InvalidOid;
 
 
 /* GUC parameter */
-int            Password_encryption = PASSWORD_TYPE_MD5;
+int            Password_encryption = PASSWORD_TYPE_SCRAM_SHA_256;
 
 /* Hook to check passwords in CreateRole() and AlterRole() */
 check_password_hook_type check_password_hook = NULL;

diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c
index 17c15348efc2f98601528f7cb553516e33f8d136..28b2fc72d64062f07b114a455fc268fc8122e13b 100644 (file)
--- a/src/backend/utils/misc/guc.c
+++ b/src/backend/utils/misc/guc.c
@@ -463,18 +463,9 @@ static const struct config_enum_entry plan_cache_mode_options[] = {
    {NULL, 0, false}
 };
 
-/*
- * password_encryption used to be a boolean, so accept all the likely
- * variants of "on", too. "off" used to store passwords in plaintext,
- * but we don't support that anymore.
- */
 static const struct config_enum_entry password_encryption_options[] = {
    {"md5", PASSWORD_TYPE_MD5, false},
    {"scram-sha-256", PASSWORD_TYPE_SCRAM_SHA_256, false},
-   {"on", PASSWORD_TYPE_MD5, true},
-   {"true", PASSWORD_TYPE_MD5, true},
-   {"yes", PASSWORD_TYPE_MD5, true},
-   {"1", PASSWORD_TYPE_MD5, true},
    {NULL, 0, false}
 };
 
@@ -4733,7 +4724,7 @@ static struct config_enum ConfigureNamesEnum[] =
            NULL
        },
        &Password_encryption,
-       PASSWORD_TYPE_MD5, password_encryption_options,
+       PASSWORD_TYPE_SCRAM_SHA_256, password_encryption_options,
        NULL, NULL, NULL
    },
 

diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sample
index ac02bd0c00acbfc6554748460c602606ae3e8984..3a25287a391d73b0041fa38fda18064d69052eb6 100644 (file)
--- a/src/backend/utils/misc/postgresql.conf.sample
+++ b/src/backend/utils/misc/postgresql.conf.sample
@@ -88,7 +88,7 @@
 # - Authentication -
 
 #authentication_timeout = 1min     # 1s-600s
-#password_encryption = md5     # md5 or scram-sha-256
+#password_encryption = scram-sha-256   # scram-sha-256 or md5
 #db_user_namespace = off
 
 # GSSAPI using Kerberos

diff --git a/src/bin/initdb/initdb.c b/src/bin/initdb/initdb.c
index 5a787681f9655ac82d581b68e968cc202e99a12c..786672b1b6553703f0f09d54a60d12306a12c367 100644 (file)
--- a/src/bin/initdb/initdb.c
+++ b/src/bin/initdb/initdb.c
@@ -1204,12 +1204,18 @@ setup_config(void)
                              "#update_process_title = off");
 #endif
 
-   if (strcmp(authmethodlocal, "scram-sha-256") == 0 ||
-       strcmp(authmethodhost, "scram-sha-256") == 0)
+   /*
+    * Change password_encryption setting to md5 if md5 was chosen as an
+    * authentication method, unless scram-sha-256 was also chosen.
+    */
+   if ((strcmp(authmethodlocal, "md5") == 0 &&
+        strcmp(authmethodhost, "scram-sha-256") != 0) ||
+       (strcmp(authmethodhost, "md5") == 0 &&
+        strcmp(authmethodlocal, "scram-sha-256") != 0))
    {
        conflines = replace_token(conflines,
-                                 "#password_encryption = md5",
-                                 "password_encryption = scram-sha-256");
+                                 "#password_encryption = scram-sha-256",
+                                 "password_encryption = md5");
    }
 
    /*
@@ -2373,12 +2379,7 @@ check_need_password(const char *authmethodlocal, const char *authmethodhost)
         strcmp(authmethodhost, "scram-sha-256") == 0) &&
        !(pwprompt || pwfilename))
    {
-       pg_log_error("must specify a password for the superuser to enable %s authentication",
-                    (strcmp(authmethodlocal, "md5") == 0 ||
-                     strcmp(authmethodlocal, "password") == 0 ||
-                     strcmp(authmethodlocal, "scram-sha-256") == 0)
-                    ? authmethodlocal
-                    : authmethodhost);
+       pg_log_error("must specify a password for the superuser to enable password authentication");
        exit(1);
    }
 }

diff --git a/src/test/regress/expected/password.out b/src/test/regress/expected/password.out
index 2b852aa324dd8a056b42cf3615d5c76b2ff5a4bf..7c84c9da33777c50952c78b9605768212c99c19f 100644 (file)
--- a/src/test/regress/expected/password.out
+++ b/src/test/regress/expected/password.out
@@ -5,13 +5,14 @@
 SET password_encryption = 'novalue'; -- error
 ERROR:  invalid value for parameter "password_encryption": "novalue"
 HINT:  Available values: md5, scram-sha-256.
-SET password_encryption = true; -- ok
+SET password_encryption = true; -- error
+ERROR:  invalid value for parameter "password_encryption": "true"
+HINT:  Available values: md5, scram-sha-256.
 SET password_encryption = 'md5'; -- ok
 SET password_encryption = 'scram-sha-256'; -- ok
 -- consistency of password entries
 SET password_encryption = 'md5';
 CREATE ROLE regress_passwd1 PASSWORD 'role_pwd1';
-SET password_encryption = 'on';
 CREATE ROLE regress_passwd2 PASSWORD 'role_pwd2';
 SET password_encryption = 'scram-sha-256';
 CREATE ROLE regress_passwd3 PASSWORD 'role_pwd3';

diff --git a/src/test/regress/sql/password.sql b/src/test/regress/sql/password.sql
index 1e7e19eafa8721e68d2511d17e5f45e70a98281b..98f49916e5d5f9d51647a47abfc01d782e6fb09f 100644 (file)
--- a/src/test/regress/sql/password.sql
+++ b/src/test/regress/sql/password.sql
@@ -4,14 +4,13 @@
 
 -- Tests for GUC password_encryption
 SET password_encryption = 'novalue'; -- error
-SET password_encryption = true; -- ok
+SET password_encryption = true; -- error
 SET password_encryption = 'md5'; -- ok
 SET password_encryption = 'scram-sha-256'; -- ok
 
 -- consistency of password entries
 SET password_encryption = 'md5';
 CREATE ROLE regress_passwd1 PASSWORD 'role_pwd1';
-SET password_encryption = 'on';
 CREATE ROLE regress_passwd2 PASSWORD 'role_pwd2';
 SET password_encryption = 'scram-sha-256';
 CREATE ROLE regress_passwd3 PASSWORD 'role_pwd3';