Re: Not storing MD5 hashed passwords

["Quiroga, Damian" <damian.quiroga@xxxxxxxxx>]

Excellent answers. Thanks everyone.

 

From: pgsql-general-owner@xxxxxxxxxxxxxx [mailto:pgsql-general-owner@xxxxxxxxxxxxxx] On Behalf Of Jeff Janes
Sent: Wednesday, October 14, 2015 7:19 PM
To: John R Pierce
Cc: pgsql-general@xxxxxxxxxxxxxx
Subject: Re: [GENERAL] Not storing MD5 hashed passwords

 

On Wed, Oct 14, 2015 at 1:41 PM, John R Pierce <pierce@xxxxxxxxxxxx> wrote:

On 10/14/2015 1:31 PM, Quiroga, Damian wrote:

 

Does postgres support other (stronger) hashing algorithms than MD5 to store the database passwords at disk?

If not, is there any plan to move away from MD5?

 

There are proposals to do so, the most advanced one I know of is with SCRAM.  But I don't think any of them have turned into actual plans yet.  But you are not restricted to PostgreSQL's built in password authentication methods, you can use its options for PAM, LDAP, RADIUS, GSSAPI, or SSPI, in which case it doesn't store passwords at all but delegates that to someone else.

 

if you can read the password database, you already have superuser access to the full database

 

Unless you've captured a backup tape, or scraped some bits off a not-quite-degaussed-enough discarded hard drive,or any number of other things that can get you an offline copy of some (or all) of the data, but doesn't give you live access to the running database (until you hack the passwords)

 

Cheers,

 

Jeff