This is the most secure of the currently provided methods, but it is not supported by older client libraries.
Until now, in a instance based on 6.2 (or default branch) with SCRAM-SHA-256 no problems were detected.
Maybe in future, with more feedback from community we can change installation guides to use this method and provide more security in a custom install for new users.
For reference, to change an existing instance you need:
1) modify your postgresql.conf: password_encryption = scram-sha-256
2) change pg_hba.conf auth method from md5 to scram-sha-256 TYPE DATABASE USER ADDRESS METHOD host all all 1.2.3.4/32 scram-sha-256
3) Reload your database to apply new configurations select pg_reload_conf();
4) Change users password: alter user postgres with password 'add_new_password';
NOTE: to get a list with all users that passwords should be changed use: SELECT rolname FROM pg_authid WHERE rolcanlogin;
Environment
None
Activity
Show:
Murilo Habermann Torquato May 16, 2019 at 12:59 PM
,
afaik there's nothing related to scram-sha-256 that we can use for that.
Talking with some friends they pointed me to an old project called Jasypt (but as you said it's just an file encrypt tool)
I don't know if is possible with this new method, but something would be very good to have is a better way to save the postgresql password encrypted by default in idempiereEnv.properties - at this moment the default is save it unencrypted, and I think it can be saved encrypted, but again, if encrypted with the weak default algorithm is still very unsafe, would be better to save it with a stronger encryption way. Maybe this scram-sha-256 allows something like that?
Since (https://jdbc.postgresql.org/documentation/changelog.html#version_42.2.0) JDBC 42.2.0 and PostgreSQL 10 we can use SCRAM-SHA-256 authentication method.
As we can see in https://www.postgresql.org/docs/current/auth-password.html this method is:
Until now, in a instance based on 6.2 (or default branch) with SCRAM-SHA-256 no problems were detected.
Maybe in future, with more feedback from community we can change installation guides to use this method and provide more security in a custom install for new users.
For reference, to change an existing instance you need:
1) modify your postgresql.conf:
password_encryption = scram-sha-256
2) change pg_hba.conf auth method from md5 to scram-sha-256
TYPE DATABASE USER ADDRESS METHOD
host all all 1.2.3.4/32 scram-sha-256
3) Reload your database to apply new configurations
select pg_reload_conf();
4) Change users password:
alter user postgres with password 'add_new_password';
NOTE: to get a list with all users that passwords should be changed use:
SELECT rolname FROM pg_authid WHERE rolcanlogin;