Defaulting password encryption for version above 14 #1406
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
|
cruelsmith
requested review from
alexjfisher,
bastelfreak,
deric,
ekohl,
SimonHoenscheid and
smortex
as code owners
smortex
reviewed
Jul 10, 2023
|
@cruelsmith can you please rebase? |
* Fix missing handling of allowed undef value of parameter hash of postgresql::postgresql_password * Fix edgecase where passwords starting with md5 but are not followed by 32 base64 chars will not be hashed by postgresql::postgresql_password * Fix case of postgresql::postgresql_password where sensitive hashes are wrongly handled * Extend spec tests for 'postgresql_password function' to cover this * Add respecting password_encryption for all internal postgresql::postgresql_password calls * Add respecting password_encryption for postgresql::backup::pg_dump * Add spec tests for new hash type handling of postgresql::server::role See https://www.postgresql.org/docs/14/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION
* Fixing lint 140chars inside REFERENCE.md
bastelfreak
approved these changes
Jul 31, 2023
SimonHoenscheid
approved these changes
Jul 31, 2023
|
@cruelsmith: Good job! Linked to: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
See https://www.postgresql.org/docs/14/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION
Note: That this change is will upgrade the password hashes to use
scram-sha-256if a postgres version 14 or higher is used,update_passwordis set to true and cleartext passwords are used.It will not change pre-hashed passwords.
If you want to force a default password_encryption you can set
postgresql::server::password_encryptionto the wanted one.Note: The function
postgresql::postgresql_passwordstill has a hard default ofmd5as hash type. Usepostgresql::server::password_encryptionas fourth parameter when using it on your own to ensure you use the version based default one.