From c1c888a9de0c062182552e66ca766b252ca140bc Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Fri, 21 Sep 2001 20:31:49 +0000 Subject: Code review for MD5 authorization patch. Clean up some breakage (salts were always zero!?), add much missing documentation. --- doc/src/sgml/client-auth.sgml | 18 ++- doc/src/sgml/protocol.sgml | 231 +++++++++++++++++++++++++------------- doc/src/sgml/ref/alter_user.sgml | 20 +++- doc/src/sgml/ref/create_user.sgml | 37 ++++-- doc/src/sgml/runtime.sgml | 5 +- 5 files changed, 212 insertions(+), 99 deletions(-) (limited to 'doc/src') diff --git a/doc/src/sgml/client-auth.sgml b/doc/src/sgml/client-auth.sgml index f1914fe9d36..33dba495df8 100644 --- a/doc/src/sgml/client-auth.sgml +++ b/doc/src/sgml/client-auth.sgml @@ -1,4 +1,4 @@ - + Client Authentication @@ -219,7 +219,13 @@ hostssl database IP-address Like the md5 method but uses older crypt - authentication for pre-7.2 clients. + authentication for pre-7.2 clients. md5 + is preferred, unless you need to support old clients that + do not have md5. The crypt + method is not compatible with encrypting passwords in + pg_shadow, and it has been observed to fail + when client and server machines have different implementations + of the crypt() library routine. @@ -284,7 +290,7 @@ hostssl database IP-addresspam - This authentication type operates similar to + This authentication type operates similarly to password, with the main difference that it will use PAM (Pluggable Authentication Modules) as the authentication mechanism. The authentication @@ -448,9 +454,9 @@ host all 192.168.0.0 255.255.0.0 ident omicron Alternative passwords cannot be used when using the md5 - or crypt methods. The file will still be evaluated as - usual but the password field will simply be ignored and the - pg_shadow password will be used. + or crypt methods. The file will be read as + usual, but the password field will simply be ignored and the + pg_shadow password will always be used. diff --git a/doc/src/sgml/protocol.sgml b/doc/src/sgml/protocol.sgml index b69719f7b93..83b03792829 100644 --- a/doc/src/sgml/protocol.sgml +++ b/doc/src/sgml/protocol.sgml @@ -1,4 +1,4 @@ - + Frontend/Backend Protocol @@ -142,10 +142,11 @@ - AuthenticationUnencryptedPassword + AuthenticationCleartextPassword - The frontend must then send an UnencryptedPasswordPacket. If + The frontend must then send a PasswordPacket containing the + password in clear-text form. If this is the correct password, the server responds with an AuthenticationOk, otherwise it responds with an ErrorResponse. @@ -153,16 +154,47 @@ - AuthenticationEncryptedPassword + AuthenticationCryptPassword - The frontend must then send an EncryptedPasswordPacket. If + The frontend must then send a PasswordPacket containing the + password encrypted via crypt(3), using the 2-character salt + specified in the AuthenticationCryptPassword packet. If this is the correct password, the server responds with an AuthenticationOk, otherwise it responds with an ErrorResponse. + + AuthenticationMD5Password + + + The frontend must then send a PasswordPacket containing the + password encrypted via MD5, using the 4-character salt + specified in the AuthenticationMD5Password packet. If + this is the correct password, the server responds with an + AuthenticationOk, otherwise it responds with an ErrorResponse. + + + + + + AuthenticationSCMCredential + + + This method is only possible for local Unix-domain connections + on platforms that support SCM credential messages. The frontend + must issue an SCM credential message and then send a single data + byte. (The contents of the data byte are uninteresting; it's + only used to ensure that the server waits long enough to receive + the credential message.) If the credential is acceptable, + the server responds with an + AuthenticationOk, otherwise it responds with an ErrorResponse. + + + + @@ -857,7 +889,7 @@ AuthenticationKerberosV5 (B) -AuthenticationUnencryptedPassword (B) +AuthenticationCleartextPassword (B) @@ -879,19 +911,18 @@ AuthenticationUnencryptedPassword (B) - Specifies that an unencrypted password is required. + Specifies that a cleartext password is required. - - + -AuthenticationEncryptedPassword (B) +AuthenticationCryptPassword (B) @@ -913,7 +944,7 @@ AuthenticationEncryptedPassword (B) - Specifies that an encrypted password is required. + Specifies that a crypt()-encrypted password is required. @@ -932,6 +963,85 @@ AuthenticationEncryptedPassword (B) + + + +AuthenticationMD5Password (B) + + + + + + + + Byte1('R') + + + + Identifies the message as an authentication request. + + + + + + Int32(5) + + + + Specifies that an MD5-encrypted password is required. + + + + + + Byte4 + + + + The salt to use when encrypting the password. + + + + + + + + + + + +AuthenticationSCMCredential (B) + + + + + + + + Byte1('R') + + + + Identifies the message as an authentication request. + + + + + + Int32(6) + + + + Specifies that an SCM credentials message is required. + + + + + + + + + BackendKeyData (B) @@ -1271,40 +1381,7 @@ EmptyQueryResponse (B) - - -EncryptedPasswordPacket (F) - - - - - - - - Int32 - - - - The size of the packet in bytes. - - - - - - String - - - - The encrypted (using MD5 or crypt()) password. - - - - - - - - ErrorResponse (B) @@ -1599,9 +1676,43 @@ NotificationResponse (B) + + + + + + +PasswordPacket (F) + + + + + + + + Int32 + + + + The size of the packet in bytes. + + + String + + + + The password (encrypted, if requested). + + + + + + + + Query (F) @@ -1852,39 +1963,7 @@ Terminate (F) - - -UnencryptedPasswordPacket (F) - - - - - - - - Int32 - - - - The size of the packet in bytes. - - - - - - String - - - - The unencrypted password. - - - - - - - diff --git a/doc/src/sgml/ref/alter_user.sgml b/doc/src/sgml/ref/alter_user.sgml index e8258f762d8..e7f650f3882 100644 --- a/doc/src/sgml/ref/alter_user.sgml +++ b/doc/src/sgml/ref/alter_user.sgml @@ -1,5 +1,5 @@ @@ -53,13 +53,23 @@ where option can be: - [ encrypted | unencrypted ] password + password The new password to be used for this account. - Encrypted/ unencrypted - controls whether the password is stored encrypted in the - database. + + + + + + ENCRYPTED + UNENCRYPTED + + + These keywords control whether the + password is stored encrypted in pg_shadow. (See + + for more information about this choice.) diff --git a/doc/src/sgml/ref/create_user.sgml b/doc/src/sgml/ref/create_user.sgml index 3bf744f2c37..34e210c70e8 100644 --- a/doc/src/sgml/ref/create_user.sgml +++ b/doc/src/sgml/ref/create_user.sgml @@ -1,5 +1,5 @@ @@ -66,28 +66,45 @@ where option can be: If this is not specified, the highest assigned user id plus one - will be used as default. + (with a minimum of 100) will be used as default. - [ encrypted | unencrypted ] password + password Sets the user's password. If you do not plan to use password - authentication you can omit this option, otherwise the user + authentication you can omit this option, but the user won't be able to connect to a password-authenticated server. - - - ENCRYPTED/UNENCRYPTED controls whether the - password is stored encrypted in the database. Older clients may - have trouble communicating using encrypted password storage. + The password can be set or changed later, using + . + + + + + + ENCRYPTED + UNENCRYPTED + + + These keywords control whether the + password is stored encrypted in pg_shadow. (If neither + is specified, the default behavior is determined by the + PASSWORD_ENCRYPTION server parameter.) + If the presented string is already in MD5-encrypted format, + then it is stored as-is, regardless of whether + ENCRYPTED or UNENCRYPTED + is specified. This allows reloading of encrypted passwords + during dump/restore. See the chapter on client authentication in the Administrator's Guide for details on - how to set up authentication mechanisms. + how to set up authentication mechanisms. Note that older clients + may lack support for the MD5 authentication mechanism that's needed + to work with passwords that are stored encrypted. diff --git a/doc/src/sgml/runtime.sgml b/doc/src/sgml/runtime.sgml index e6095f26996..a1a1be8b1a9 100644 --- a/doc/src/sgml/runtime.sgml +++ b/doc/src/sgml/runtime.sgml @@ -1,5 +1,5 @@ @@ -1260,7 +1260,8 @@ dynamic_library_path = '/usr/local/lib/postgresql:/home/my_project/lib:$libdir' When a password is specified in CREATE USER or ALTER USER without writing either ENCRYPTED or - UNENCRYPTED, this flag determines whether the password is encrypted. + UNENCRYPTED, this flag determines whether the password is to be + encrypted. The default is off (do not encrypt the password), but this choice may change in a future release. -- cgit v1.2.3