Tom Lane wrote:
> "Glen Parker" <glenebob@nwlink.com> writes:
> > This means that the only way a password can be compromized is to see the
> > password hash in pg_shadow, and the only thing it can be used for is
> > logging into postgres throught playback. No plain-text password can be
> > obtained.
>
> Good point. If you can read the pg_shadow password entries, then you
> are already superuser w.r.t. Postgres, so what need have you to break
> into any other database user identities?
>
> I think the concern that was originally advanced about all this was
> that the database admin should not be able to read the clear-text
> passwords of his users, because far too many people use the same
> password for different purposes, and so a DBA might learn how to
> get into accounts he shouldn't have access to. The MD5 scheme does
> fix that problem (unless the other account chances to use the very
> same MD5 hash scheme we do, which seems unlikely).
Yes, I was unclear on the pg_shadow salt. The salt used in that case is
the username, so it doesn't need to be passed to the client. The client
already knows the username.
If other apps use the same encoding scheme, someone could match and know
that the user was using the same password for both applications, but it
doesn't help them know the password or break into the other app.
> Still, we had a *long* discussion about the design of the MD5 password
> scheme about a year ago, and I thought we'd come up with a design that
> was proof against this sort of attack. Need to go back and consult
> the list archives...
Yes, I had thought that seeing pg_shadow was as secure as seeing
/etc/passwd, but the user correctly points out that this is false.
Seeing pg_shadow is a much bigger problem. However, our pg_shadow is
not as visible as /etc/passwd (at least before there was a /etc/shadow).
Anyway, I wish we could improve it, but am an resigned to the fact we
can't.
--
Bruce Momjian | http://candle.pha.pa.us
pgman@candle.pha.pa.us | (610) 853-3000
+ If your life is a hard drive, | 830 Blythe Avenue
+ Christ can be your backup. | Drexel Hill, Pennsylvania 19026
