> Bruce Momjian <pgman@candle.pha.pa.us> writes:
> > We aren't. I can do that, but have not discussed it yet. If we do it
> > is clearly a protocol change. How will old clients handle longer salt,
> > and how do I know if they are older if I don't bump up the protocol
> > version number?
>
> All of this is under the aegis of a new auth method code, so it doesn't
> matter. Either clients handle the new auth method, or they don't.
OK, here is a new patch that creates a new md5 keyword on pg_hba.conf.
That certainly makes my coding easier, and when I apply the patch to use
larger salt for MD5, there is now a good reason to have a different
keyword. With the old system, they could have used an old client to
reply a sniffed packet, while now, if the host is set to MD5, they have
a much larger namespace with no fallback to crypt.
Applied.
--
Bruce Momjian | http://candle.pha.pa.us
pgman@candle.pha.pa.us | (610) 853-3000
+ If your life is a hard drive, | 830 Blythe Avenue
+ Christ can be your backup. | Drexel Hill, Pennsylvania 19026
Index: doc/src/sgml/client-auth.sgml
===================================================================
RCS file: /home/projects/pgsql/cvsroot/pgsql/doc/src/sgml/client-auth.sgml,v
retrieving revision 1.16
diff -c -r1.16 client-auth.sgml
*** doc/src/sgml/client-auth.sgml 2001/08/15 18:42:14 1.16
--- doc/src/sgml/client-auth.sgml 2001/08/16 16:14:28
***************
*** 194,219 ****
<para>
The password is sent over the wire in clear text. For better
! protection, use the <literal>crypt</literal> method.
</para>
</listitem>
</varlistentry>
<varlistentry>
! <term>crypt</>
<listitem>
<para>
Like the <literal>password</literal> method, but the password
is sent over the wire encrypted using a simple
challenge-response protocol. This protects against incidental
wire-sniffing. The name of a file may follow the
! <literal>crypt</literal> keyword. It contains a list of users
for this record.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>krb4</>
<listitem>
<para>
--- 194,230 ----
<para>
The password is sent over the wire in clear text. For better
! protection, use the <literal>md5</literal> or
! <literal>crypt</literal> methods.
</para>
</listitem>
</varlistentry>
<varlistentry>
! <term>md5</>
<listitem>
<para>
Like the <literal>password</literal> method, but the password
is sent over the wire encrypted using a simple
challenge-response protocol. This protects against incidental
wire-sniffing. The name of a file may follow the
! <literal>md5</literal> keyword. It contains a list of users
for this record.
</para>
</listitem>
</varlistentry>
<varlistentry>
+ <term>crypt</>
+ <listitem>
+ <para>
+ Like the <literal>md5</literal> method but uses older crypt
+ authentication for pre-7.2 clients.
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
<term>krb4</>
<listitem>
<para>
***************
*** 328,334 ****
# Allow a user from host 192.168.12.10 to connect to database "template1"
# if the user's password in pg_shadow is correctly supplied:
! host template1 192.168.12.10 255.255.255.255 crypt
# In the absence of preceding "host" lines, these two lines will reject
# all connection attempts from 192.168.54.1 (since that entry will be
--- 339,345 ----
# Allow a user from host 192.168.12.10 to connect to database "template1"
# if the user's password in pg_shadow is correctly supplied:
! host template1 192.168.12.10 255.255.255.255 md5
# In the absence of preceding "host" lines, these two lines will reject
# all connection attempts from 192.168.54.1 (since that entry will be
***************
*** 377,387 ****
</para>
<para>
! To restrict the set of users that are allowed to connect to
! certain databases, list the set of users in a separate file (one
! user name per line) in the same directory that
! <filename>pg_hba.conf</> is in, and mention the (base) name of the
! file after the <literal>password</> or <literal>crypt</> keyword,
respectively, in <filename>pg_hba.conf</>. If you do not use this
feature, then any user that is known to the database system can
connect to any database (so long as he passes password
--- 388,398 ----
</para>
<para>
! To restrict the set of users that are allowed to connect to certain
! databases, list the set of users in a separate file (one user name
! per line) in the same directory that <filename>pg_hba.conf</> is in,
! and mention the (base) name of the file after the
! <literal>password</>, <literal>md5</>, or <literal>crypt</> keyword,
respectively, in <filename>pg_hba.conf</>. If you do not use this
feature, then any user that is known to the database system can
connect to any database (so long as he passes password
***************
*** 414,421 ****
</para>
<para>
! Alternative passwords cannot be used when using the
! <literal>crypt</> method. The file will still be evaluated as
usual but the password field will simply be ignored and the
<literal>pg_shadow</> password will be used.
</para>
--- 425,432 ----
</para>
<para>
! Alternative passwords cannot be used when using the <literal>md5</>
! or <literal>crypt</> methods. The file will still be evaluated as
usual but the password field will simply be ignored and the
<literal>pg_shadow</> password will be used.
</para>
Index: doc/src/sgml/jdbc.sgml
===================================================================
RCS file: /home/projects/pgsql/cvsroot/pgsql/doc/src/sgml/jdbc.sgml,v
retrieving revision 1.20
diff -c -r1.20 jdbc.sgml
*** doc/src/sgml/jdbc.sgml 2001/03/11 11:06:59 1.20
--- doc/src/sgml/jdbc.sgml 2001/08/16 16:14:34
***************
*** 162,168 ****
<filename>pg_hba.conf</filename> file may need to be configured.
Refer to the <citetitle>Administrator's Guide</citetitle> for
details. The <acronym>JDBC</acronym> Driver supports trust,
! ident, password, and crypt authentication methods.
</para>
</sect2>
</sect1>
--- 162,168 ----
<filename>pg_hba.conf</filename> file may need to be configured.
Refer to the <citetitle>Administrator's Guide</citetitle> for
details. The <acronym>JDBC</acronym> Driver supports trust,
! ident, password, and md5, crypt authentication methods.
</para>
</sect2>
</sect1>
Index: src/backend/libpq/auth.c
===================================================================
RCS file: /home/projects/pgsql/cvsroot/pgsql/src/backend/libpq/auth.c,v
retrieving revision 1.58
diff -c -r1.58 auth.c
*** src/backend/libpq/auth.c 2001/08/16 04:27:18 1.58
--- src/backend/libpq/auth.c 2001/08/16 16:14:34
***************
*** 501,516 ****
status = recv_and_check_password_packet(port);
break;
- case uaMD5:
- sendAuthRequest(port, AUTH_REQ_MD5);
- if ((status = recv_and_check_password_packet(port)) == STATUS_OK)
- break;
- port->auth_method = uaCrypt;
- /* Try crypt() for old client */
- /* FALL THROUGH */
-
case uaCrypt:
sendAuthRequest(port, AUTH_REQ_CRYPT);
status = recv_and_check_password_packet(port);
break;
--- 501,513 ----
status = recv_and_check_password_packet(port);
break;
case uaCrypt:
sendAuthRequest(port, AUTH_REQ_CRYPT);
+ status = recv_and_check_password_packet(port);
+ break;
+
+ case uaMD5:
+ sendAuthRequest(port, AUTH_REQ_MD5);
status = recv_and_check_password_packet(port);
break;
Index: src/backend/libpq/hba.c
===================================================================
RCS file: /home/projects/pgsql/cvsroot/pgsql/src/backend/libpq/hba.c,v
retrieving revision 1.63
diff -c -r1.63 hba.c
*** src/backend/libpq/hba.c 2001/08/16 04:27:18 1.63
--- src/backend/libpq/hba.c 2001/08/16 16:14:35
***************
*** 226,234 ****
*userauth_p = uaKrb5;
else if (strcmp(token, "reject") == 0)
*userauth_p = uaReject;
! else if (strcmp(token, "crypt") == 0)
! /* Try MD5 first; on failure, switch to crypt() */
*userauth_p = uaMD5;
else
*error_p = true;
line = lnext(line);
--- 226,235 ----
*userauth_p = uaKrb5;
else if (strcmp(token, "reject") == 0)
*userauth_p = uaReject;
! else if (strcmp(token, "md5") == 0)
*userauth_p = uaMD5;
+ else if (strcmp(token, "crypt") == 0)
+ *userauth_p = uaCrypt;
else
*error_p = true;
line = lnext(line);
Index: src/backend/libpq/pg_hba.conf.sample
===================================================================
RCS file: /home/projects/pgsql/cvsroot/pgsql/src/backend/libpq/pg_hba.conf.sample,v
retrieving revision 1.24
diff -c -r1.24 pg_hba.conf.sample
*** src/backend/libpq/pg_hba.conf.sample 2001/08/15 18:42:15 1.24
--- src/backend/libpq/pg_hba.conf.sample 2001/08/16 16:14:35
***************
*** 115,127 ****
# utility. Remember, these passwords override pg_shadow
# passwords.
#
! # crypt: Same as "password", but authentication is done by
# encrypting the password sent over the network. This is
# always preferable to "password" except for old clients
! # that don't support "crypt". Also, crypt can use
! # usernames stored in secondary password files but not
! # secondary passwords.
#
# ident: For TCP/IP connections, authentication is done by contacting
# the ident server on the client host. (CAUTION: this is only
# as secure as the client machine!) On machines that support
--- 115,129 ----
# utility. Remember, these passwords override pg_shadow
# passwords.
#
! # md5: Same as "password", but authentication is done by
# encrypting the password sent over the network. This is
# always preferable to "password" except for old clients
! # that don't support it. Also, md5 can use usernames stored
! # in secondary password files but not secondary passwords.
#
+ # crypt: Same as "md5", but uses crypt for pre-7.2 clients. You can
+ # not store encrypted passwords if you use this option.
+ #
# ident: For TCP/IP connections, authentication is done by contacting
# the ident server on the client host. (CAUTION: this is only
# as secure as the client machine!) On machines that support
***************
*** 173,179 ****
# if the user's password in pg_shadow is correctly supplied:
#
# TYPE DATABASE IP_ADDRESS MASK AUTH_TYPE AUTH_ARGUMENT
! # host template1 192.168.12.10 255.255.255.255 crypt
#
# In the absence of preceding "host" lines, these two lines will reject
# all connection from 192.168.54.1 (since that entry will be matched
--- 175,181 ----
# if the user's password in pg_shadow is correctly supplied:
#
# TYPE DATABASE IP_ADDRESS MASK AUTH_TYPE AUTH_ARGUMENT
! # host template1 192.168.12.10 255.255.255.255 md5
#
# In the absence of preceding "host" lines, these two lines will reject
# all connection from 192.168.54.1 (since that entry will be matched
Index: src/include/libpq/hba.h
===================================================================
RCS file: /home/projects/pgsql/cvsroot/pgsql/src/include/libpq/hba.h,v
retrieving revision 1.23
diff -c -r1.23 hba.h
*** src/include/libpq/hba.h 2001/08/15 18:42:15 1.23
--- src/include/libpq/hba.h 2001/08/16 16:14:41
***************
*** 36,43 ****
uaIdent,
uaPassword,
uaCrypt,
! uaMD5 /* This starts as uaCrypt from pg_hba.conf, but gets
! overridden if the client supports MD5 */
} UserAuth;
typedef struct Port hbaPort;
--- 36,42 ----
uaIdent,
uaPassword,
uaCrypt,
! uaMD5
} UserAuth;
typedef struct Port hbaPort;
