Обсуждение: pg_hba.conf and crypt/password

i seem to recall setting this up before, but now i can't seem to
get passwords working the way i want.

i'm running 7.0.3 on FreeBSD 4.3-RC.

i've set the entry in pg_hba.conf to both "crypt" and "password".

i've used "ALTER USER pgsql WITH PASSWORD 'test';

regardless of "crypt" or "password", psql allows entry using "test".

what i want is for the pg_shadow file to contain encrypted passwords like
/etc/passwd, and for the server to encrypt the plain text password handed
to it and compare with the crypto-gunge in pg_shadow.

is this not what "crypt" is supposed to do?

--
[ Jim Mercer          jim@pneumonoultramicroscopicsilicovolcanoconiosis.ca ]
[          Reptilian Research -- Longer Life through Colder Blood          ]
[ aka                        jim@reptiles.org              +1 416 410-5633 ]

Jim Mercer wrote:
  >
  >i seem to recall setting this up before, but now i can't seem to
  >get passwords working the way i want.
  >
  >i'm running 7.0.3 on FreeBSD 4.3-RC.
  >
  >i've set the entry in pg_hba.conf to both "crypt" and "password".
  >
  >i've used "ALTER USER pgsql WITH PASSWORD 'test';
  >
  >regardless of "crypt" or "password", psql allows entry using "test".
  >
  >what i want is for the pg_shadow file to contain encrypted passwords like
  >/etc/passwd, and for the server to encrypt the plain text password handed
  >to it and compare with the crypto-gunge in pg_shadow.
  >
  >is this not what "crypt" is supposed to do?

'crypt' encrypts the password during transmission; apart from that there
is no difference from 'password'.

--
Oliver Elphick                                Oliver.Elphick@lfix.co.uk
Isle of Wight                              http://www.lfix.co.uk/oliver
PGP: 1024R/32B8FAA1: 97 EA 1D 47 72 3F 28 47  6B 7E 39 CC 56 E4 C1 47
GPG: 1024D/3E1D0C1C: CA12 09E0 E8D5 8870 5839  932A 614D 4C34 3E1D 0C1C
                 ========================================
     "If we confess our sins, he is faithful and just to
      forgive us our sins, and to cleanse us from all
      unrighteousness."           I John 1:9

Jim Mercer writes:

> i seem to recall setting this up before, but now i can't seem to
> get passwords working the way i want.
>
> i'm running 7.0.3 on FreeBSD 4.3-RC.
>
> i've set the entry in pg_hba.conf to both "crypt" and "password".
>
> i've used "ALTER USER pgsql WITH PASSWORD 'test';
>
> regardless of "crypt" or "password", psql allows entry using "test".

This is correct.

> what i want is for the pg_shadow file to contain encrypted passwords like
> /etc/passwd, and for the server to encrypt the plain text password handed
> to it and compare with the crypto-gunge in pg_shadow.

This is not possible.

> is this not what "crypt" is supposed to do?

Crypt encrypts the password on the wire, not in the storage.

--
Peter Eisentraut      peter_e@gmx.net       http://yi.org/peter-e/

On Sat, Mar 31, 2001 at 10:31:36AM +0200, Peter Eisentraut wrote:
> > what i want is for the pg_shadow file to contain encrypted passwords like
> > /etc/passwd, and for the server to encrypt the plain text password handed
> > to it and compare with the crypto-gunge in pg_shadow.
>
> This is not possible.

i had a look at the code, and figured i wanted similar behaviour for:

host all 127.0.0.1 255.255.255.255 password /dir/passwd.file

but, rather than have a file, i wanted to use pg_shadow with encrypted
passwords.

so the following patch allows for:

host all 127.0.0.1 255.255.255.255 password pg_shadow

where "pg_shadow" is a special key (like "ident sameuser") to set up this
behaviour.

the patch is done in such a way that it will not impact existing installations

--
[ Jim Mercer          jim@pneumonoultramicroscopicsilicovolcanoconiosis.ca ]
[          Reptilian Research -- Longer Life through Colder Blood          ]
[ aka                        jim@reptiles.org              +1 416 410-5633 ]


*** auth.c.orig    Fri Mar 30 19:37:08 2001
--- auth.c    Fri Mar 30 19:28:20 2001
***************
*** 695,701 ****
  static int
  checkPassword(Port *port, char *user, char *password)
  {
!     if (port->auth_method == uaPassword && port->auth_arg[0] != '\0')
          return verify_password(port->auth_arg, user, password);

      return crypt_verify(port, user, password);
--- 695,702 ----
  static int
  checkPassword(Port *port, char *user, char *password)
  {
!     if (port->auth_method == uaPassword && port->auth_arg[0] != '\0'
!             && strcmp(port->auth_arg, "pg_shadow") != 0)
          return verify_password(port->auth_arg, user, password);

      return crypt_verify(port, user, password);
*** crypt.c.orig    Fri Mar 30 19:38:26 2001
--- crypt.c    Fri Mar 30 19:39:07 2001
***************
*** 280,287 ****
       * authentication method being used for this connection.
       */

!     crypt_pwd =
!         (port->auth_method == uaCrypt ? crypt(passwd, port->salt) : passwd);

      if (!strcmp(pgpass, crypt_pwd))
      {
--- 280,294 ----
       * authentication method being used for this connection.
       */

!     if (port->auth_method == uaCrypt)
!         crypt_pwd = crypt(passwd, port->salt);
!     else
!     {
!         /* if port->auth_arg, encrypt password from client before compare */
!         if (port->auth_arg[0] != 0)
!             pgpass = crypt(pgpass, passwd);
!         crypt_pwd = passwd;
!     }

      if (!strcmp(pgpass, crypt_pwd))
      {