Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Commit 818fd4a

Browse files
hlinnakahlinnaka
committed
Support SCRAM-SHA-256 authentication (RFC 5802 and 7677).
This introduces a new generic SASL authentication method, similar to the GSS and SSPI methods. The server first tells the client which SASL authentication mechanism to use, and then the mechanism-specific SASL messages are exchanged in AuthenticationSASLcontinue and PasswordMessage messages. Only SCRAM-SHA-256 is supported at the moment, but this allows adding more SASL mechanisms in the future, without changing the overall protocol. Support for channel binding, aka SCRAM-SHA-256-PLUS is left for later. The SASLPrep algorithm, for pre-processing the password, is not yet implemented. That could cause trouble, if you use a password with non-ASCII characters, and a client library that does implement SASLprep. That will hopefully be added later. Authorization identities, as specified in the SCRAM-SHA-256 specification, are ignored. SET SESSION AUTHORIZATION provides more or less the same functionality, anyway. If a user doesn't exist, perform a "mock" authentication, by constructing an authentic-looking challenge on the fly. The challenge is derived from a new system-wide random value, "mock authentication nonce", which is created at initdb, and stored in the control file. We go through these motions, in order to not give away the information on whether the user exists, to unauthenticated users. Bumps PG_CONTROL_VERSION, because of the new field in control file. Patch by Michael Paquier and Heikki Linnakangas, reviewed at different stages by Robert Haas, Stephen Frost, David Steele, Aleksander Alekseev, and many others. Discussion: https://www.postgresql.org/message-id/CAB7nPqRbR3GmFYdedCAhzukfKrgBLTLtMvENOmPrVWREsZkF8g%40mail.gmail.com Discussion: https://www.postgresql.org/message-id/CAB7nPqSMXU35g%3DW9X74HVeQp0uvgJxvYOuA4A-A3M%2B0wfEBv-w%40mail.gmail.com Discussion: https://www.postgresql.org/message-id/55192AFE.6080106@iki.fi
1 parent 273c458 commit 818fd4a

38 files changed

+2866
-77
lines changed

‎contrib/pgcrypto/.gitignore

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,3 @@
1-
# Source file copied from src/common
2-
/sha2.c
3-
/sha2_openssl.c
4-
51
# Generated subdirectories
62
/log/
73
/results/

‎contrib/pgcrypto/Makefile

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
# contrib/pgcrypto/Makefile
22

3-
INT_SRCS = md5.c sha1.c sha2.c internal.c internal-sha2.c blf.c rijndael.c \
3+
INT_SRCS = md5.c sha1.c internal.c internal-sha2.c blf.c rijndael.c \
44
pgp-mpi-internal.c imath.c
55
INT_TESTS = sha2
66

7-
OSSL_SRCS = openssl.c pgp-mpi-openssl.c sha2_openssl.c
7+
OSSL_SRCS = openssl.c pgp-mpi-openssl.c
88
OSSL_TESTS = sha2 des 3des cast5
99

1010
ZLIB_TST = pgp-compression
@@ -59,13 +59,6 @@ SHLIB_LINK += $(filter -leay32, $(LIBS))
5959
SHLIB_LINK += -lws2_32
6060
endif
6161

62-
# Compiling pgcrypto with those two raw files is necessary as long
63-
# as none of their routines are used by the backend code. Note doing
64-
# so can either result in library loading failures or linking resolution
65-
# failures at compilation depending on the environment used.
66-
sha2.c sha2_openssl.c: % : $(top_srcdir)/src/common/%
67-
rm -f $@ && $(LN_S) $< .
68-
6962
rijndael.o: rijndael.tbl
7063

7164
rijndael.tbl:

‎doc/src/sgml/catalogs.sgml

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1334,14 +1334,8 @@
13341334
<entry><structfield>rolpassword</structfield></entry>
13351335
<entry><type>text</type></entry>
13361336
<entry>
1337-
Password (possibly encrypted); null if none. If the password
1338-
is encrypted, this column will begin with the string <literal>md5</>
1339-
followed by a 32-character hexadecimal MD5 hash. The MD5 hash
1340-
will be of the user's password concatenated to their user name.
1341-
For example, if user <literal>joe</> has password <literal>xyzzy</>,
1342-
<productname>PostgreSQL</> will store the md5 hash of
1343-
<literal>xyzzyjoe</>. A password that does not follow that
1344-
format is assumed to be unencrypted.
1337+
Password (possibly encrypted); null if none. The format depends
1338+
on the form of encryption used.
13451339
</entry>
13461340
</row>
13471341

@@ -1355,6 +1349,21 @@
13551349
</tgroup>
13561350
</table>
13571351

1352+
<para>
1353+
For an MD5 encrypted password, <structfield>rolpassword</structfield>
1354+
column will begin with the string <literal>md5</> followed by a
1355+
32-character hexadecimal MD5 hash. The MD5 hash will be of the user's
1356+
password concatenated to their user name. For example, if user
1357+
<literal>joe</> has password <literal>xyzzy</>, <productname>PostgreSQL</>
1358+
will store the md5 hash of <literal>xyzzyjoe</>. If the password is
1359+
encrypted with SCRAM-SHA-256, it consists of 5 fields separated by colons.
1360+
The first field is the constant <literal>scram-sha-256</literal>, to
1361+
identify the password as a SCRAM-SHA-256 verifier. The second field is a
1362+
salt, Base64-encoded, and the third field is the number of iterations used
1363+
to generate the password. The fourth field and fifth field are the stored
1364+
key and server key, respectively, in hexadecimal format. A password that
1365+
does not follow either of those formats is assumed to be unencrypted.
1366+
</para>
13581367
</sect1>
13591368

13601369

‎doc/src/sgml/client-auth.sgml

Lines changed: 46 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -422,6 +422,17 @@ hostnossl <replaceable>database</replaceable> <replaceable>user</replaceable>
422422
</listitem>
423423
</varlistentry>
424424

425+
<varlistentry>
426+
<term><literal>scram</></term>
427+
<listitem>
428+
<para>
429+
Perform SCRAM-SHA-256 authentication to verify the user's
430+
password.
431+
See <xref linkend="auth-password"> for details.
432+
</para>
433+
</listitem>
434+
</varlistentry>
435+
425436
<varlistentry>
426437
<term><literal>password</></term>
427438
<listitem>
@@ -673,13 +684,19 @@ host postgres all 192.168.93.0/24 ident
673684
# "postgres" if the user's password is correctly supplied.
674685
#
675686
# TYPE DATABASE USER ADDRESS METHOD
676-
host postgres all 192.168.12.10/32 md5
687+
host postgres all 192.168.12.10/32 scram
677688

678689
# Allow any user from hosts in the example.com domain to connect to
679690
# any database if the user's password is correctly supplied.
680691
#
692+
# Most users use SCRAM authentication, but some users use older clients
693+
# that don't support SCRAM authentication, and need to be able to log
694+
# in using MD5 authentication. Such users are put in the @md5users
695+
# group, everyone else must use SCRAM.
696+
#
681697
# TYPE DATABASE USER ADDRESS METHOD
682-
host all all .example.com md5
698+
host all @md5users .example.com md5
699+
host all all .example.com scram
683700

684701
# In the absence of preceding "host" lines, these two lines will
685702
# reject all connections from 192.168.54.1 (since that entry will be
@@ -907,21 +924,37 @@ omicron bryanh guest1
907924
</indexterm>
908925

909926
<para>
910-
The password-based authentication methods are <literal>md5</>
911-
and <literal>password</>. These methods operate
927+
The password-based authentication methods are <literal>scram</>
928+
<literal>md5</> and <literal>password</>. These methods operate
912929
similarly except for the way that the password is sent across the
913-
connection, namely MD5-hashed and clear-text respectively.
930+
connection.
931+
</para>
932+
933+
<para>
934+
Plain <literal>password</> sends the password in clear-text, and is
935+
therefore vulnerable to password <quote>sniffing</> attacks. It should
936+
always be avoided if possible. If the connection is protected by SSL
937+
encryption then <literal>password</> can be used safely, though.
938+
(Though SSL certificate authentication might be a better choice if one
939+
is depending on using SSL).
940+
</para>
941+
942+
943+
<para>
944+
<literal>scram</> performs SCRAM-SHA-256 authentication, as described
945+
in <ulink url="https://tools.ietf.org/html/rfc5802">RFC5802</ulink>. It
946+
is a challenge-response scheme, that prevents password sniffing on
947+
untrusted connections. It is more secure than the <literal>md5</>
948+
method, but might not be supported by older clients.
914949
</para>
915950

916951
<para>
917-
If you are at all concerned about password
918-
<quote>sniffing</> attacks then <literal>md5</> is preferred.
919-
Plain <literal>password</> should always be avoided if possible.
920-
However, <literal>md5</> cannot be used with the <xref
921-
linkend="guc-db-user-namespace"> feature. If the connection is
922-
protected by SSL encryption then <literal>password</> can be used
923-
safely (though SSL certificate authentication might be a better
924-
choice if one is depending on using SSL).
952+
In <literal>md5</>, the client sends a hash of a random challenge,
953+
generated by the server, and the password. It prevents password sniffing,
954+
but is less secure than <literal>scram</>, and provides no protection
955+
if an attacker manages to steal the password hash from the server.
956+
<literal>md5</> cannot be used with the <xref
957+
linkend="guc-db-user-namespace"> feature.
925958
</para>
926959

927960
<para>

‎doc/src/sgml/config.sgml

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1193,9 +1193,10 @@ include_dir 'conf.d'
11931193
password is to be encrypted. The default value is <literal>md5</>, which
11941194
stores the password as an MD5 hash. Setting this to <literal>plain</> stores
11951195
it in plaintext. <literal>on</> and <literal>off</> are also accepted, as
1196-
aliases for <literal>md5</> and <literal>plain</>, respectively.
1197-
</para>
1198-
1196+
aliases for <literal>md5</> and <literal>plain</>, respectively. Setting
1197+
this parameter to <literal>scram</> will encrypt the password with
1198+
SCRAM-SHA-256.
1199+
</para>
11991200
</listitem>
12001201
</varlistentry>
12011202

‎doc/src/sgml/protocol.sgml

Lines changed: 142 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -228,11 +228,11 @@
228228
The server then sends an appropriate authentication request message,
229229
to which the frontend must reply with an appropriate authentication
230230
response message (such as a password).
231-
For all authentication methods except GSSAPI and SSPI, there is at most
232-
one request and one response. In some methods, no response
231+
For all authentication methods except GSSAPI, SSPI and SASL, there is at
232+
most one request and one response. In some methods, no response
233233
at all is needed from the frontend, and so no authentication request
234-
occurs. For GSSAPI and SSPI, multiple exchanges of packets may be needed
235-
to complete the authentication.
234+
occurs. For GSSAPI, SSPI and SASL, multiple exchanges of packets may be
235+
needed to complete the authentication.
236236
</para>
237237

238238
<para>
@@ -366,6 +366,35 @@
366366
</listitem>
367367
</varlistentry>
368368

369+
<varlistentry>
370+
<term>AuthenticationSASL</term>
371+
<listitem>
372+
<para>
373+
The frontend must now initiate a SASL negotiation, using the SASL
374+
mechanism specified in the message. The frontend will send a
375+
PasswordMessage with the first part of the SASL data stream in
376+
response to this. If further messages are needed, the server will
377+
respond with AuthenticationSASLContinue.
378+
</para>
379+
</listitem>
380+
381+
</varlistentry>
382+
<varlistentry>
383+
<term>AuthenticationSASLContinue</term>
384+
<listitem>
385+
<para>
386+
This message contains the response data from the previous step
387+
of SASL negotiation (AuthenticationSASL, or a previous
388+
AuthenticationSASLContinue). If the SASL data in this message
389+
indicates more data is needed to complete the authentication,
390+
the frontend must send that data as another PasswordMessage. If
391+
SASL authentication is completed by this message, the server
392+
will next send AuthenticationOk to indicate successful authentication
393+
or ErrorResponse to indicate failure.
394+
</para>
395+
</listitem>
396+
</varlistentry>
397+
369398
</variablelist>
370399
</para>
371400

@@ -2782,6 +2811,114 @@ AuthenticationGSSContinue (B)
27822811
</listitem>
27832812
</varlistentry>
27842813

2814+
<varlistentry>
2815+
<term>
2816+
AuthenticationSASL (B)
2817+
</term>
2818+
<listitem>
2819+
<para>
2820+
2821+
<variablelist>
2822+
<varlistentry>
2823+
<term>
2824+
Byte1('R')
2825+
</term>
2826+
<listitem>
2827+
<para>
2828+
Identifies the message as an authentication request.
2829+
</para>
2830+
</listitem>
2831+
</varlistentry>
2832+
<varlistentry>
2833+
<term>
2834+
Int32
2835+
</term>
2836+
<listitem>
2837+
<para>
2838+
Length of message contents in bytes, including self.
2839+
</para>
2840+
</listitem>
2841+
</varlistentry>
2842+
<varlistentry>
2843+
<term>
2844+
Int32(10)
2845+
</term>
2846+
<listitem>
2847+
<para>
2848+
Specifies that SASL authentication is started.
2849+
</para>
2850+
</listitem>
2851+
</varlistentry>
2852+
<varlistentry>
2853+
<term>
2854+
String
2855+
</term>
2856+
<listitem>
2857+
<para>
2858+
Name of a SASL authentication mechanism.
2859+
</para>
2860+
</listitem>
2861+
</varlistentry>
2862+
</variablelist>
2863+
2864+
</para>
2865+
</listitem>
2866+
</varlistentry>
2867+
2868+
<varlistentry>
2869+
<term>
2870+
AuthenticationSASLContinue (B)
2871+
</term>
2872+
<listitem>
2873+
<para>
2874+
2875+
<variablelist>
2876+
<varlistentry>
2877+
<term>
2878+
Byte1('R')
2879+
</term>
2880+
<listitem>
2881+
<para>
2882+
Identifies the message as an authentication request.
2883+
</para>
2884+
</listitem>
2885+
</varlistentry>
2886+
<varlistentry>
2887+
<term>
2888+
Int32
2889+
</term>
2890+
<listitem>
2891+
<para>
2892+
Length of message contents in bytes, including self.
2893+
</para>
2894+
</listitem>
2895+
</varlistentry>
2896+
<varlistentry>
2897+
<term>
2898+
Int32(11)
2899+
</term>
2900+
<listitem>
2901+
<para>
2902+
Specifies that this message contains SASL-mechanism specific
2903+
data.
2904+
</para>
2905+
</listitem>
2906+
</varlistentry>
2907+
<varlistentry>
2908+
<term>
2909+
Byte<replaceable>n</replaceable>
2910+
</term>
2911+
<listitem>
2912+
<para>
2913+
SASL data, specific to the SASL mechanism being used.
2914+
</para>
2915+
</listitem>
2916+
</varlistentry>
2917+
</variablelist>
2918+
2919+
</para>
2920+
</listitem>
2921+
</varlistentry>
27852922

27862923
<varlistentry>
27872924
<term>
@@ -4544,7 +4681,7 @@ PasswordMessage (F)
45444681
<listitem>
45454682
<para>
45464683
Identifies the message as a password response. Note that
4547-
this is also used for GSSAPI and SSPI response messages
4684+
this is also used for GSSAPI, SSPI and SASL response messages
45484685
(which is really a design error, since the contained data
45494686
is not a null-terminated string in that case, but can be
45504687
arbitrary binary data).

‎doc/src/sgml/ref/create_role.sgml

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -231,12 +231,17 @@ CREATE ROLE <replaceable class="PARAMETER">name</replaceable> [ [ WITH ] <replac
231231
encrypted in the system catalogs. (If neither is specified,
232232
the default behavior is determined by the configuration
233233
parameter <xref linkend="guc-password-encryption">.) If the
234-
presented password string is already in MD5-encrypted format,
235-
then it is stored encrypted as-is, regardless of whether
236-
<literal>ENCRYPTED</> or <literal>UNENCRYPTED</> is specified
237-
(since the system cannot decrypt the specified encrypted
238-
password string). This allows reloading of encrypted
239-
passwords during dump/restore.
234+
presented password string is already in MD5-encrypted or
235+
SCRAM-encrypted format, then it is stored encrypted as-is,
236+
regardless of whether <literal>ENCRYPTED</> or <literal>UNENCRYPTED</>
237+
is specified (since the system cannot decrypt the specified encrypted
238+
password string). This allows reloading of encrypted passwords
239+
during dump/restore.
240+
</para>
241+
242+
<para>
243+
Note that older clients might lack support for the SCRAM
244+
authentication mechanism.
240245
</para>
241246
</listitem>
242247
</varlistentry>

0 commit comments

Comments
 (0)