database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-11-06 07:49:08 +03:00
Code Activity

Change default of password_encryption to scram-sha-256

Browse Source 
Also, the legacy values on/true/yes/1 for password_encryption that
mapped to md5 are removed.  The only valid values are now
scram-sha-256 and md5.

Reviewed-by: Jonathan S. Katz <jkatz@postgresql.org>
Discussion: https://www.postgresql.org/message-id/flat/d5b0ad33-7d94-bdd1-caac-43a1c782cab2%402ndquadrant.com
This commit is contained in:
Peter Eisentraut
2020-06-10 16:16:37 +02:00
parent 5a4ada71a8
commit c7eab0e97e
7 changed files with 23 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/backend/utils/misc/guc.c
View File

@@ -463,18 +463,9 @@ static const struct config_enum_entry plan_cache_mode_options[] = {
{NULL, 0, false}
};
/*
* password_encryption used to be a boolean, so accept all the likely
* variants of "on", too. "off" used to store passwords in plaintext,
* but we don't support that anymore.
*/
static const struct config_enum_entry password_encryption_options[] = {
{"md5", PASSWORD_TYPE_MD5, false},
{"scram-sha-256", PASSWORD_TYPE_SCRAM_SHA_256, false},
{"on", PASSWORD_TYPE_MD5, true},
{"true", PASSWORD_TYPE_MD5, true},
{"yes", PASSWORD_TYPE_MD5, true},
{"1", PASSWORD_TYPE_MD5, true},
{NULL, 0, false}
};
@@ -4733,7 +4724,7 @@ static struct config_enum ConfigureNamesEnum[] =
NULL
},
&Password_encryption,
PASSWORD_TYPE_MD5, password_encryption_options,
PASSWORD_TYPE_SCRAM_SHA_256, password_encryption_options,
NULL, NULL, NULL
},

2
src/backend/utils/misc/postgresql.conf.sample
View File

@@ -88,7 +88,7 @@
# - Authentication -
#authentication_timeout = 1min # 1s-600s
#password_encryption = md5 # md5 or scram-sha-256
#password_encryption = scram-sha-256 # scram-sha-256 or md5
#db_user_namespace = off
# GSSAPI using Kerberos