On 1 September 2010 16:17, Josh Kupershmidt <schmiddy@gmail.com> wrote:
> On Wed, Sep 1, 2010 at 5:02 AM, Thom Brown <thom@linux.com> wrote:
>
>> SELECT usename
>> FROM pg_shadow
>> WHERE passwd = 'md5' || md5(usename)
>> OR passwd = 'md5' || md5('company_password');
>
> I think this query should be:
>
> SELECT usename
> FROM pg_shadow
> WHERE passwd = 'md5' || md5(usename || usename) OR
> passwd = 'md5' || md5('company_password' || usename);
>
> Since the md5 passwords in pg_shadow (and pg_authid) are created as:
> MD5(password || username)
>
> By the way, the documentation pages for pg_authid and pg_shadow don't
> mention that md5 passwords are stored in this fashion, perhaps they
> should? Or is this fact documented somewhere else I'm not seeing?
Yes, I had discovered this previously but obviously I've got a memory
leak. Actually, doesn't this apply to roles too?
SELECT rolname
FROM pg_authid
WHERE rolpassword = 'md5' || md5(rolname || rolname) OR
rolpassword = 'md5' || md5('company_password' || rolname);
--
Thom Brown
Twitter: @darkixion
IRC (freenode): dark_ixion
Registered Linux user: #516935
