Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit554e56e

Browse files
committed
Expand secondary password file feature, so that you can use these
files to restrict the set of users that can connect to a databasebut can still use the pg_shadow password. (You just leave off thepassword field in the secondary file.)
1 parent1c2f735 commit554e56e

File tree

7 files changed

+115
-92
lines changed

7 files changed

+115
-92
lines changed

‎doc/src/sgml/client-auth.sgml

Lines changed: 62 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<!-- $Header: /cvsroot/pgsql/doc/src/sgml/client-auth.sgml,v 1.1 2000/06/18 21:24:51 petere Exp $ -->
1+
<!-- $Header: /cvsroot/pgsql/doc/src/sgml/client-auth.sgml,v 1.2 2000/07/04 16:31:51 petere Exp $ -->
22

33
<chapter id="client-authentication">
44
<title>Client Authentication</title>
@@ -202,15 +202,15 @@ host all 192.168.2.0 255.255.255.0 ident othermap
202202
<term>password</term>
203203
<listitem>
204204
<para>
205-
The client is required to supply a passwordfor the connection
205+
The client is required to supply a passwordwith the connection
206206
attempt which is required to match the password that was set up
207-
for the user. (These passwords are separate from any operating
208-
sytem password.)
207+
for the user.
209208
</para>
210209
<para>
211-
An optional password file may be specified after the
212-
<literal>password</literal> keyword to obtain the password from
213-
that file rather than the pg_shadow system catalog.
210+
An optional file name may be specified after the
211+
<literal>password</literal> keyword. This file is expected to
212+
contain a list of users that this record pertains to, and
213+
optionally alternative passwords.
214214
</para>
215215
<para>
216216
The password is sent over the wire in clear text. For better
@@ -225,11 +225,11 @@ host all 192.168.2.0 255.255.255.0 ident othermap
225225
<para>
226226
Like the <literal>password</literal> method, but the password
227227
is sent over the wire encrypted using a simple
228-
challenge-response protocol.Note that this is still not
228+
challenge-response protocol.This is still not
229229
cryptographically secure but it protects against incidental
230-
wire-sniffing.Interestingly enough, the
231-
<literal>crypt</literal>does not support secondary password
232-
files.
230+
wire-sniffing.The name of a file may follow the
231+
<literal>crypt</literal>keyword that contains a list of users
232+
that this record pertains to.
233233
</para>
234234
</listitem>
235235
</varlistentry>
@@ -276,24 +276,36 @@ host all 192.168.2.0 255.255.255.0 ident othermap
276276
<sect2>
277277
<title>Password authentication</title>
278278
<para>
279-
Ordinarily, the password for each database user is stored in the
280-
pg_shadow system catalog table. Passwords can be managed with the
281-
query language commands <command>CREATE USER</command> and
282-
<command>ALTER USER</command>, e.g., <userinput>CREATE USER foo
283-
WITH PASSWORD 'secret';</userinput>. By default, that is, if no
284-
password has explicitly been set up, the stored password is
285-
<quote>NULL</quote> and password authentication will always fail
286-
for that user.
279+
<productname>Postgres</> database passwords are separate from any
280+
operating system user passwords. Ordinarily, the password for each
281+
database user is stored in the pg_shadow system catalog table.
282+
Passwords can be managed with the query language commands
283+
<command>CREATE USER</command> and <command>ALTER USER</command>,
284+
e.g., <userinput>CREATE USER foo WITH PASSWORD
285+
'secret';</userinput>. By default, that is, if no password has
286+
explicitly been set up, the stored password is <quote>NULL</quote>
287+
and password authentication will always fail for that user.
287288
</para>
288289

289290
<para>
290-
Secondary password files can be used if a given set of passwords
291-
should only apply to a particular database or set thereof.
292-
Secondary password files have a format similar to the standard
293-
Unix password file <filename>/etc/passwd</filename>, that is,
294-
<synopsis>
291+
To restrict the set of users that are allowed to connect to
292+
certain databases, list the set of users in a separate file (one
293+
user name per line) in the same directory that
294+
<filename>pg_hba.conf</> is in, and mention the (base) name of the
295+
file after the <literal>password</> or <literal>crypt</> keyword,
296+
respectively, in <filename>pg_hba.conf</>. If you do not use this
297+
feature, then any user that is known to the database system can
298+
connect (as long as he passes password authentication, of course).
299+
</para>
300+
301+
<para>
302+
These files can also be used a apply a different set of passwords
303+
to a particular database or set thereof. In that case, the files
304+
have a format similar to the standard Unix password file
305+
<filename>/etc/passwd</filename>, that is,
306+
<synopsis>
295307
<replaceable>username</replaceable>:<replaceable>password</replaceable>
296-
</synopsis>
308+
</synopsis>
297309
Any extra colon separated fields following the password are
298310
ignored. The password is expected to be encrypted using the
299311
system's <function>crypt()</function> function. The utility
@@ -303,20 +315,29 @@ host all 192.168.2.0 255.255.255.0 ident othermap
303315
</para>
304316

305317
<para>
306-
Secondary password files can alsobeused to restrict certain
307-
users from connecting to certain databases at all. This is
308-
currently not possible to achieve using the normal password
309-
mechanism (because usersandpasswords are global across all
310-
databases). If a user is not listed in the applicablepassword
311-
file the connection will be refused.
318+
Lines with and without passwords canbemixed in secondary
319+
password files. Lines without password indicate use the main
320+
password in <literal>pg_shadow</> that is managed by
321+
<command>CREATE USER</>and<command>ALTER USER</>. Lines with
322+
passwords will cause that password to be used. Apassword entry of
323+
<quote>+</quote> also means using the pg_shadow password.
312324
</para>
313325

314326
<para>
315-
Note that using secondary password files means that one can no
316-
longer use <command>ALTER USER</command> to change one's password.
317-
It will still appear to work but the password one is actually
318-
changing is not thepasswordthat the systemwillend up using.
327+
Alternative passwords cannot be used when using the
328+
<literal>crypt</> method. The file will still be evaluated as
329+
usual but the password field will simply be ignored and the
330+
<literal>pg_shadow</>password willbe used.
319331
</para>
332+
333+
<para>
334+
Note that using alternative passwords like this means that one can
335+
no longer use <command>ALTER USER</command> to change one's
336+
password. It will still appear to work but the password one is
337+
actually changing is not the password that the system will end up
338+
using.
339+
</para>
340+
320341
</sect2>
321342

322343
<sect2>
@@ -361,14 +382,15 @@ integrated here. -->
361382
The <quote>Identification Protocol</quote> is described in
362383
<citetitle>RFC 1413</citetitle>. Virtually every Unix-like
363384
operating systems ships with an ident server that listens on TCP
364-
port 113 by default. The basic functionality ofthe ident server
385+
port 113 by default. The basic functionality ofan ident server
365386
is to answer questions like <quote>What user initiated the
366387
connection that goes out of your port <replaceable>X</replaceable>
367388
and connects to my port <replaceable>Y</replaceable>?</quote>.
368-
Since both <replaceable>X</replaceable> and
369-
<replaceable>Y</replaceable> are known,
370-
<productname>Postgres</productname> could theoretically determine
371-
the operating system user for any given connection this way.
389+
Since <productname>Postgres</> knows both <replaceable>X</> and
390+
<replaceable>Y</> when a physical connection is established, it
391+
can interrogate the ident server on the host of the connecting
392+
client and could theoretically determine the operating system user
393+
for any given connection this way.
372394
</para>
373395

374396
<para>

‎src/backend/libpq/auth.c

Lines changed: 5 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
*
99
*
1010
* IDENTIFICATION
11-
* $Header: /cvsroot/pgsql/src/backend/libpq/auth.c,v 1.47 2000/05/27 04:13:05 momjian Exp $
11+
* $Header: /cvsroot/pgsql/src/backend/libpq/auth.c,v 1.48 2000/07/04 16:31:53 petere Exp $
1212
*
1313
*-------------------------------------------------------------------------
1414
*/
@@ -52,9 +52,6 @@ static void auth_failed(Port *port);
5252

5353

5454
#ifdefKRB4
55-
/* This has to be ifdef'd out because krb.h does exist. This needs
56-
to be fixed.
57-
*/
5855
/*----------------------------------------------------------------
5956
* MIT Kerberos authentication system - protocol version 4
6057
*----------------------------------------------------------------
@@ -141,9 +138,6 @@ pg_krb4_recvauth(Port *port)
141138

142139

143140
#ifdefKRB5
144-
/* This needs to be ifdef'd out because krb5.h doesn't exist. This needs
145-
to be fixed.
146-
*/
147141
/*----------------------------------------------------------------
148142
* MIT Kerberos authentication system - protocol version 5
149143
*----------------------------------------------------------------
@@ -692,16 +686,14 @@ readPasswordPacket(void *arg, PacketLen len, void *pkt)
692686

693687

694688
/*
695-
* Use the local flat password file if clear passwords are used and the file is
696-
* specified. Otherwise use the password in the pg_shadow table, encrypted or
697-
* not.
689+
* Handle `password' and `crypt' records. If an auth argument was
690+
* specified, use the respective file. Else use pg_shadow passwords.
698691
*/
699-
700692
staticint
701693
checkPassword(Port*port,char*user,char*password)
702694
{
703-
if (port->auth_method==uaPassword&&port->auth_arg[0]!='\0')
704-
returnverify_password(port->auth_arg,user,password);
695+
if (port->auth_arg[0]!='\0')
696+
returnverify_password(port,user,password);
705697

706698
returncrypt_verify(port,user,password);
707699
}

‎src/backend/libpq/crypt.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
* Dec 17, 1997 - Todd A. Brandys
1010
*Orignal Version Completed.
1111
*
12-
* $Id: crypt.c,v 1.26 2000/07/03 20:48:30 petere Exp $
12+
* $Id: crypt.c,v 1.27 2000/07/04 16:31:53 petere Exp $
1313
*
1414
*-------------------------------------------------------------------------
1515
*/
@@ -249,7 +249,7 @@ crypt_getloginfo(const char *user, char **passwd, char **valuntil)
249249
/*-------------------------------------------------------------------------*/
250250

251251
int
252-
crypt_verify(Port*port,constchar*user,constchar*pgpass)
252+
crypt_verify(constPort*port,constchar*user,constchar*pgpass)
253253
{
254254

255255
char*passwd,

‎src/backend/libpq/password.c

Lines changed: 20 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
* Portions Copyright (c) 1996-2000, PostgreSQL, Inc
33
* Portions Copyright (c) 1994, Regents of the University of California
44
*
5-
* $Id: password.c,v 1.29 2000/06/02 15:57:21 momjian Exp $
5+
* $Id: password.c,v 1.30 2000/07/04 16:31:53 petere Exp $
66
*
77
*/
88

@@ -15,18 +15,19 @@
1515

1616
#include"libpq/libpq.h"
1717
#include"libpq/password.h"
18+
#include"libpq/crypt.h"
1819
#include"miscadmin.h"
1920

2021
int
21-
verify_password(char*auth_arg,char*user,char*password)
22+
verify_password(constPort*port,constchar*user,constchar*password)
2223
{
2324
char*pw_file_fullname;
2425
FILE*pw_file;
2526

26-
pw_file_fullname= (char*)palloc(strlen(DataDir)+strlen(auth_arg)+2);
27+
pw_file_fullname= (char*)palloc(strlen(DataDir)+strlen(port->auth_arg)+2);
2728
strcpy(pw_file_fullname,DataDir);
2829
strcat(pw_file_fullname,"/");
29-
strcat(pw_file_fullname,auth_arg);
30+
strcat(pw_file_fullname,port->auth_arg);
3031

3132
pw_file=AllocateFile(pw_file_fullname,PG_BINARY_R);
3233
if (!pw_file)
@@ -52,23 +53,32 @@ verify_password(char *auth_arg, char *user, char *password)
5253
*test_pw;
5354

5455
fgets(pw_file_line,sizeof(pw_file_line),pw_file);
56+
/* kill the newline */
57+
if (pw_file_line[strlen(pw_file_line)-1]=='\n')
58+
pw_file_line[strlen(pw_file_line)-1]='\0';
59+
5560
p=pw_file_line;
5661

5762
test_user=strtok(p,":");
5863
test_pw=strtok(NULL,":");
59-
if (!test_user|| !test_pw||
60-
test_user[0]=='\0'||test_pw[0]=='\0')
64+
if (!test_user||test_user[0]=='\0')
6165
continue;
6266

63-
/* kill the newline */
64-
if (test_pw[strlen(test_pw)-1]=='\n')
65-
test_pw[strlen(test_pw)-1]='\0';
66-
6767
if (strcmp(user,test_user)==0)
6868
{
6969
/* we're outta here one way or the other, so close file */
7070
FreeFile(pw_file);
7171

72+
/*
73+
* If the password is empty of "+" then we use the regular
74+
* pg_shadow passwords. If we use crypt then we have to
75+
* use pg_shadow passwords no matter what.
76+
*/
77+
if (port->auth_method==uaCrypt
78+
||test_pw==NULL||test_pw[0]=='\0'
79+
||strcmp(test_pw,"+")==0)
80+
returncrypt_verify(port,user,password);
81+
7282
if (strcmp(crypt(password,test_pw),test_pw)==0)
7383
{
7484
/* it matched. */

‎src/bin/pg_passwd/pg_passwd.c

Lines changed: 24 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -105,13 +105,9 @@ read_pwd_file(char *filename)
105105

106106
/* get user name */
107107
p=line;
108-
if ((q=strchr(p,':'))==NULL)
109-
{
110-
fprintf(stderr,"%s: line %d: illegal format.\n",
111-
filename,npwds+1);
112-
exit(1);
113-
}
114-
*(q++)='\0';
108+
if ((q=strchr(p,':'))!=NULL)
109+
*q='\0';
110+
115111
if (strlen(p)==0)
116112
{
117113
fprintf(stderr,"%s: line %d: null user name.\n",
@@ -131,23 +127,23 @@ read_pwd_file(char *filename)
131127
}
132128

133129
/* get password field */
134-
p=q;
135-
q=strchr(p,':');
136-
137-
/*
138-
* --- don't care ----- if ((q = strchr(p, ':')) == NULL) {
139-
* fprintf(stderr, "%s: line %d: illegal format.\n", filename,
140-
* npwds + 1); exit(1); }
141-
*/
142-
143-
if (q!=NULL)
144-
*(q++)='\0';
145-
if (strlen(p)!=13)
130+
if (q)
146131
{
147-
fprintf(stderr,"WARNING: %s: line %d: illegal password length.\n",
148-
filename,npwds+1);
132+
p=q+1;
133+
q=strchr(p,':');
134+
135+
if (q!=NULL)
136+
*(q++)='\0';
137+
138+
if (strlen(p)!=13&&strcmp(p,"+")!=0)
139+
{
140+
fprintf(stderr,"WARNING: %s: line %d: invalid password length.\n",
141+
filename,npwds+1);
142+
}
143+
pwds[npwds].pwd=strdup(p);
149144
}
150-
pwds[npwds].pwd=strdup(p);
145+
else
146+
pwds[npwds].pwd=NULL;
151147

152148
/* rest of the line is treated as is */
153149
if (q==NULL)
@@ -193,9 +189,12 @@ write_pwd_file(char *filename, char *bkname)
193189
/* write file */
194190
for (i=0;i<npwds;++i)
195191
{
196-
fprintf(fp,"%s:%s%s%s\n",pwds[i].uname,pwds[i].pwd,
197-
pwds[i].rest ?":" :"",
198-
pwds[i].rest ?pwds[i].rest :"");
192+
fprintf(fp,"%s",pwds[i].uname);
193+
if (pwds[i].pwd)
194+
fprintf(fp,":%s",pwds[i].pwd);
195+
if (pwds[i].rest)
196+
fprintf(fp,":%s",pwds[i].rest);
197+
fprintf(fp,"\n");
199198
}
200199

201200
fclose(fp);

‎src/include/libpq/crypt.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,6 @@ extern char *crypt_getpwdreloadfilename(void);
2626
externMsgTypecrypt_salt(constchar*user);
2727

2828
#endif
29-
externintcrypt_verify(Port*port,constchar*user,constchar*pgpass);
29+
externintcrypt_verify(constPort*port,constchar*user,constchar*pgpass);
3030

3131
#endif

‎src/include/libpq/password.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#ifndefPASSWORD_H
22
#definePASSWORD_H
33

4-
intverify_password(char*auth_arg,char*user,char*password);
4+
intverify_password(constPort*port,constchar*user,constchar*password);
55

66
#endif

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp