bugtraq - Re: Postgres: pg_hba.conf, md5, pg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 20 Apr 2005 15:44:09 -0400
From: Stephen Frost <sfrost@...wman.net>
To: "David F. Skoll" <dfs@...ringpenguin.com>
Cc: pgsql-hackers@...tgresql.org, bugtraq@...urityfocus.com
Subject: Re: Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords

* David F. Skoll (dfs@...ringpenguin.com) wrote:
> Stephen Frost wrote:
> >   The md5 hash which is generated for and stored in pg_shadow does not
> >   use a random salt but instead uses the username which can generally be
> >   determined ahead of time (especially for the 'postgres' superuser
> >   account).
> 
> I noted that this was a problem back in August, 2002:
> 
> http://archives.postgresql.org/pgsql-admin/2002-08/msg00253.php
> 
> Then, as now, the developers weren't very concerned.

I have some hopes that pointing out the rather large problem with the
md5 authentication mechanism in pg_hba.conf will lead them to discourage
it's use and thus reduce the occourances of the salt being made
available to the user giving more weight to the usefullness of having it
be a random salt.  Additionally, it's been a few years, perhaps
viewpoints have changed.

	Stephen

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)