database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-23 03:21:12 +03:00
Code Activity

Add new MD5 pg_hba.conf keyword. Prevent fallback to crypt.

Browse Source
This commit is contained in:
Bruce Momjian
2001-08-16 16:24:16 +00:00
parent f7eedfdff2
commit bcb0ccf5be
6 changed files with 48 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
src/backend/libpq/auth.c
View File

@ -8,7 +8,7 @@
*
*
* IDENTIFICATION
* $Header: /cvsroot/pgsql/src/backend/libpq/auth.c,v 1.58 2001/08/16 04:27:18 momjian Exp $
* $Header: /cvsroot/pgsql/src/backend/libpq/auth.c,v 1.59 2001/08/16 16:24:15 momjian Exp $
*
*-------------------------------------------------------------------------
*/
@ -501,19 +501,16 @@ ClientAuthentication(Port *port)
status = recv_and_check_password_packet(port);
break;
case uaMD5:
sendAuthRequest(port, AUTH_REQ_MD5);
if ((status = recv_and_check_password_packet(port)) == STATUS_OK)
break;
port->auth_method = uaCrypt;
/* Try crypt() for old client */
/* FALL THROUGH */
case uaCrypt:
sendAuthRequest(port, AUTH_REQ_CRYPT);
status = recv_and_check_password_packet(port);
break;
case uaMD5:
sendAuthRequest(port, AUTH_REQ_MD5);
status = recv_and_check_password_packet(port);
break;
case uaTrust:
status = STATUS_OK;
break;

7
src/backend/libpq/hba.c
View File

@ -10,7 +10,7 @@
*
*
* IDENTIFICATION
* $Header: /cvsroot/pgsql/src/backend/libpq/hba.c,v 1.63 2001/08/16 04:27:18 momjian Exp $
* $Header: /cvsroot/pgsql/src/backend/libpq/hba.c,v 1.64 2001/08/16 16:24:15 momjian Exp $
*
*-------------------------------------------------------------------------
*/
@ -226,9 +226,10 @@ parse_hba_auth(List *line, ProtocolVersion proto, UserAuth *userauth_p,
*userauth_p = uaKrb5;
else if (strcmp(token, "reject") == 0)
*userauth_p = uaReject;
else if (strcmp(token, "crypt") == 0)
/* Try MD5 first; on failure, switch to crypt() */
else if (strcmp(token, "md5") == 0)
*userauth_p = uaMD5;
else if (strcmp(token, "crypt") == 0)
*userauth_p = uaCrypt;
else
*error_p = true;
line = lnext(line);

12
src/backend/libpq/pg_hba.conf.sample
View File

@ -115,13 +115,15 @@
# utility. Remember, these passwords override pg_shadow
# passwords.
#
# crypt: Same as "password", but authentication is done by
# md5: Same as "password", but authentication is done by
# encrypting the password sent over the network. This is
# always preferable to "password" except for old clients
# that don't support "crypt". Also, crypt can use
# usernames stored in secondary password files but not
# secondary passwords.
# that don't support it. Also, md5 can use usernames stored
# in secondary password files but not secondary passwords.
#
# crypt: Same as "md5", but uses crypt for pre-7.2 clients. You can
# not store encrypted passwords if you use this option.
#
# ident: For TCP/IP connections, authentication is done by contacting
# the ident server on the client host. (CAUTION: this is only
# as secure as the client machine!) On machines that support
@ -173,7 +175,7 @@
# if the user's password in pg_shadow is correctly supplied:
#
# TYPE DATABASE IP_ADDRESS MASK AUTH_TYPE AUTH_ARGUMENT
# host template1 192.168.12.10 255.255.255.255 crypt
# host template1 192.168.12.10 255.255.255.255 md5
#
# In the absence of preceding "host" lines, these two lines will reject
# all connection from 192.168.54.1 (since that entry will be matched

5
src/include/libpq/hba.h
View File

@ -4,7 +4,7 @@
* Interface to hba.c
*
*
* $Id: hba.h,v 1.23 2001/08/15 18:42:15 momjian Exp $
* $Id: hba.h,v 1.24 2001/08/16 16:24:16 momjian Exp $
*
*-------------------------------------------------------------------------
*/
@ -36,8 +36,7 @@ typedef enum UserAuth
uaIdent,
uaPassword,
uaCrypt,
uaMD5 /* This starts as uaCrypt from pg_hba.conf, but gets
overridden if the client supports MD5 */
uaMD5
} UserAuth;
typedef struct Port hbaPort;