{"id":12627,"date":"2019-07-11T08:43:09","date_gmt":"2019-07-11T06:43:09","guid":{"rendered":"https:\/\/www.dbi-services.com\/blog\/migrating-your-users-from-md5-to-scram-authentication-in-postgresql\/"},"modified":"2019-07-11T08:43:09","modified_gmt":"2019-07-11T06:43:09","slug":"migrating-your-users-from-md5-to-scram-authentication-in-postgresql","status":"publish","type":"post","link":"https:\/\/www.dbi-services.com\/blog\/migrating-your-users-from-md5-to-scram-authentication-in-postgresql\/","title":{"rendered":"Migrating your users from md5 to scram authentication in PostgreSQL"},"content":{"rendered":"<p>One of the new features in PostgreSQL 10 was the introduction of <a href=\"https:\/\/www.postgresql.org\/docs\/10\/release-10.html\" target=\"_blank\" rel=\"noopener noreferrer\">stronger password authentication based on SCRAM-SHA-256<\/a>. How can you migrate your existing users that currently use md5 authentication to the new method without any interruption? Actually that is quite easy, as you will see in a few moments, but there is one important point to consider: Not every client\/driver does already support SCRAM-SHA-256 authentication so you need to check that before. Here is the <a href=\"https:\/\/wiki.postgresql.org\/wiki\/List_of_drivers\" target=\"_blank\" rel=\"noopener noreferrer\">list of the drivers<\/a> and their support for SCRAM-SHA-256. <\/p>\n<p><!--more--><\/p>\n<p>The default method that PostgreSQL uses to encrypt password is defined by the <a href=\"https:\/\/www.postgresql.org\/docs\/current\/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION\" target=\"_blank\" rel=\"noopener noreferrer\">&#8220;password_encryption&#8221;<\/a> parameter:<\/p>\n<pre class=\"brush: sql; gutter: true; first-line: 1\">\npostgres=# show password_encryption;\n password_encryption \n---------------------\n md5\n(1 row)\n<\/pre>\n<p>Let&#8217;s assume we have a user that was created like this in the past:<\/p>\n<pre class=\"brush: sql; gutter: true; first-line: 1\">\npostgres=# create user u1 login password 'u1';\nCREATE ROLE\n<\/pre>\n<p>With the default method of md5 the hashed password looks like this:<\/p>\n<pre class=\"brush: sql; gutter: true; first-line: 1\">\npostgres=# select passwd from pg_shadow where usename = 'u1';\n               passwd                \n-------------------------------------\n md58026a39c502750413402a90d9d8bae3c\n(1 row)\n<\/pre>\n<p>As you can see the hash starts with md5 so we now that this hash was generated by the md5 algorithm. When we want this user to use scram-sha-256 instead, what do we need to do? The first step is to change the <a href=\"https:\/\/www.postgresql.org\/docs\/current\/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION\" target=\"_blank\" rel=\"noopener noreferrer\">&#8220;password_encryption&#8221;<\/a> parameter:<\/p>\n<pre class=\"brush: sql; gutter: true; first-line: 1\">\npostgres=# alter system set password_encryption = 'scram-sha-256';\nALTER SYSTEM\npostgres=# select pg_reload_conf();\n pg_reload_conf \n----------------\n t\npostgres=# select current_setting('password_encryption');\n current_setting \n-----------------\n scram-sha-256\n(1 row)\n<\/pre>\n<p>From now on the server will use scram-sha-256 and not anymore md5. But what happens when our user wants to connect to the instance once we changed that? Currently this is defined in <a href=\"https:\/\/www.postgresql.org\/docs\/current\/auth-pg-hba-conf.html\" target=\"_blank\" rel=\"noopener noreferrer\">pg_hba.conf<\/a>:<\/p>\n<pre class=\"brush: sql; gutter: true; first-line: 1\">\npostgres=&gt; ! grep u1 $PGDATA\/pg_hba.conf\nhost    postgres        u1              192.168.22.1\/24         md5\n<\/pre>\n<p>Even though the default is not md5 anymore the user can still connect to the instance because the password hash did not change for that user:<\/p>\n<pre class=\"brush: sql; gutter: true; first-line: 1\">\npostgres=&gt; ! grep u1 $PGDATA\/pg_hba.conf\nhost    postgres        u1              192.168.22.1\/24         md5\n\npostgres@rhel8pg:\/home\/postgres\/ [PGDEV] psql -h 192.168.22.100 -p 5433 -U u1 postgres\nPassword for user u1: \npsql (13devel)\nType \"help\" for help.\n\npostgres=&gt; \n<\/pre>\n<p>Once the user changed the password:<\/p>\n<pre class=\"brush: sql; gutter: true; first-line: 1\">\npostgres@rhel8pg:\/home\/postgres\/ [PGDEV] psql -h 192.168.22.100 -p 5433 -U u1 postgres\nPassword for user u1: \npsql (13devel)\nType \"help\" for help.\n\npostgres=&gt; password\nEnter new password: \nEnter it again: \npostgres=&gt; \n<\/pre>\n<p>&#8230; the hash of the new password is not md5 but SCRAM-SHA-256:<\/p>\n<pre class=\"brush: sql; gutter: true; first-line: 1\">\npostgres=# select passwd from pg_shadow where usename = 'u1';\n                                                                passwd                               &gt;\n-----------------------------------------------------------------------------------------------------&gt;\n SCRAM-SHA-256$4096:CypPmOW5\/uIu4NvGJa+FNA==$PNGhlmRinbEKaFoPzi7T0hWk0emk18Ip9tv6mYIguAQ=:J9vr5CQDuKE&gt;\n(1 row)\n<\/pre>\n<p>One could expect that from now on the user is not able to connect anymore as we did not change pg_hba.conf until now:<\/p>\n<pre class=\"brush: sql; gutter: true; first-line: 1\">\npostgres@rhel8pg:\/home\/postgres\/ [PGDEV] psql -h 192.168.22.100 -p 5433 -U u1 postgres\nPassword for user u1: \npsql (13devel)\nType \"help\" for help.\n\npostgres=&gt; \n<\/pre>\n<p>But in reality that still works as the server now uses the SCRAM-SHA-256 algorithm. So once all the users changed their passwords you can safely switch the rule in pg_hba.conf and you&#8217;re done:<\/p>\n<pre class=\"brush: sql; gutter: true; first-line: 1\">\npostgres=&gt; ! grep u1 $PGDATA\/pg_hba.conf\nhost    postgres        u1              192.168.22.1\/24         scram-sha-256\n\npostgres=# select pg_reload_conf();\n pg_reload_conf \n----------------\n t\n(1 row)\n<\/pre>\n<p>You just need to make sure that all the users do not have a hash starting with md5 but the new one starting with SCRAM-SHA-256.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>One of the new features in PostgreSQL 10 was the introduction of stronger password authentication based on SCRAM-SHA-256. How can you migrate your existing users that currently use md5 authentication to the new method without any interruption? Actually that is quite easy, as you will see in a few moments, but there is one important [&hellip;]<\/p>\n","protected":false},"author":28,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[229],"tags":[77],"type_dbi":[],"class_list":["post-12627","post","type-post","status-publish","format-standard","hentry","category-database-administration-monitoring","tag-postgresql"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.8 (Yoast SEO v28.8) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Migrating your users from md5 to scram authentication in PostgreSQL - dbi Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.dbi-services.com\/blog\/migrating-your-users-from-md5-to-scram-authentication-in-postgresql\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Migrating your users from md5 to scram authentication in PostgreSQL\" \/>\n<meta property=\"og:description\" content=\"One of the new features in PostgreSQL 10 was the introduction of stronger password authentication based on SCRAM-SHA-256. How can you migrate your existing users that currently use md5 authentication to the new method without any interruption? Actually that is quite easy, as you will see in a few moments, but there is one important [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.dbi-services.com\/blog\/migrating-your-users-from-md5-to-scram-authentication-in-postgresql\/\" \/>\n<meta property=\"og:site_name\" content=\"dbi Blog\" \/>\n<meta property=\"article:published_time\" content=\"2019-07-11T06:43:09+00:00\" \/>\n<meta name=\"author\" content=\"Open source Team\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Open source Team\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/migrating-your-users-from-md5-to-scram-authentication-in-postgresql\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/migrating-your-users-from-md5-to-scram-authentication-in-postgresql\\\/\"},\"author\":{\"name\":\"Open source Team\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/4bae5e5dd8c7d48edbd948772b49b202\"},\"headline\":\"Migrating your users from md5 to scram authentication in PostgreSQL\",\"datePublished\":\"2019-07-11T06:43:09+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/migrating-your-users-from-md5-to-scram-authentication-in-postgresql\\\/\"},\"wordCount\":349,\"commentCount\":0,\"keywords\":[\"PostgreSQL\"],\"articleSection\":[\"Database Administration &amp; Monitoring\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/migrating-your-users-from-md5-to-scram-authentication-in-postgresql\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/migrating-your-users-from-md5-to-scram-authentication-in-postgresql\\\/\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/migrating-your-users-from-md5-to-scram-authentication-in-postgresql\\\/\",\"name\":\"Migrating your users from md5 to scram authentication in PostgreSQL - dbi Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#website\"},\"datePublished\":\"2019-07-11T06:43:09+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/4bae5e5dd8c7d48edbd948772b49b202\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/migrating-your-users-from-md5-to-scram-authentication-in-postgresql\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/migrating-your-users-from-md5-to-scram-authentication-in-postgresql\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/migrating-your-users-from-md5-to-scram-authentication-in-postgresql\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Migrating your users from md5 to scram authentication in PostgreSQL\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/\",\"name\":\"dbi Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/4bae5e5dd8c7d48edbd948772b49b202\",\"name\":\"Open source Team\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/eb4fb12e386e8c41fdef0733e8114594cf2653e4f55e9fa2161442b8eaf3f657?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/eb4fb12e386e8c41fdef0733e8114594cf2653e4f55e9fa2161442b8eaf3f657?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/eb4fb12e386e8c41fdef0733e8114594cf2653e4f55e9fa2161442b8eaf3f657?s=96&d=mm&r=g\",\"caption\":\"Open source Team\"},\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/author\\\/open-source-team\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Migrating your users from md5 to scram authentication in PostgreSQL - dbi Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.dbi-services.com\/blog\/migrating-your-users-from-md5-to-scram-authentication-in-postgresql\/","og_locale":"en_US","og_type":"article","og_title":"Migrating your users from md5 to scram authentication in PostgreSQL","og_description":"One of the new features in PostgreSQL 10 was the introduction of stronger password authentication based on SCRAM-SHA-256. How can you migrate your existing users that currently use md5 authentication to the new method without any interruption? Actually that is quite easy, as you will see in a few moments, but there is one important [&hellip;]","og_url":"https:\/\/www.dbi-services.com\/blog\/migrating-your-users-from-md5-to-scram-authentication-in-postgresql\/","og_site_name":"dbi Blog","article_published_time":"2019-07-11T06:43:09+00:00","author":"Open source Team","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Open source Team","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.dbi-services.com\/blog\/migrating-your-users-from-md5-to-scram-authentication-in-postgresql\/#article","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/migrating-your-users-from-md5-to-scram-authentication-in-postgresql\/"},"author":{"name":"Open source Team","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/4bae5e5dd8c7d48edbd948772b49b202"},"headline":"Migrating your users from md5 to scram authentication in PostgreSQL","datePublished":"2019-07-11T06:43:09+00:00","mainEntityOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/migrating-your-users-from-md5-to-scram-authentication-in-postgresql\/"},"wordCount":349,"commentCount":0,"keywords":["PostgreSQL"],"articleSection":["Database Administration &amp; Monitoring"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.dbi-services.com\/blog\/migrating-your-users-from-md5-to-scram-authentication-in-postgresql\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.dbi-services.com\/blog\/migrating-your-users-from-md5-to-scram-authentication-in-postgresql\/","url":"https:\/\/www.dbi-services.com\/blog\/migrating-your-users-from-md5-to-scram-authentication-in-postgresql\/","name":"Migrating your users from md5 to scram authentication in PostgreSQL - dbi Blog","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/#website"},"datePublished":"2019-07-11T06:43:09+00:00","author":{"@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/4bae5e5dd8c7d48edbd948772b49b202"},"breadcrumb":{"@id":"https:\/\/www.dbi-services.com\/blog\/migrating-your-users-from-md5-to-scram-authentication-in-postgresql\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.dbi-services.com\/blog\/migrating-your-users-from-md5-to-scram-authentication-in-postgresql\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.dbi-services.com\/blog\/migrating-your-users-from-md5-to-scram-authentication-in-postgresql\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.dbi-services.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Migrating your users from md5 to scram authentication in PostgreSQL"}]},{"@type":"WebSite","@id":"https:\/\/www.dbi-services.com\/blog\/#website","url":"https:\/\/www.dbi-services.com\/blog\/","name":"dbi Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/4bae5e5dd8c7d48edbd948772b49b202","name":"Open source Team","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/eb4fb12e386e8c41fdef0733e8114594cf2653e4f55e9fa2161442b8eaf3f657?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/eb4fb12e386e8c41fdef0733e8114594cf2653e4f55e9fa2161442b8eaf3f657?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/eb4fb12e386e8c41fdef0733e8114594cf2653e4f55e9fa2161442b8eaf3f657?s=96&d=mm&r=g","caption":"Open source Team"},"url":"https:\/\/www.dbi-services.com\/blog\/author\/open-source-team\/"}]}},"_links":{"self":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/12627","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/users\/28"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/comments?post=12627"}],"version-history":[{"count":0,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/12627\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/media?parent=12627"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/categories?post=12627"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/tags?post=12627"},{"taxonomy":"type","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/type_dbi?post=12627"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}