On Thu, Jun 7, 2012 at 8:12 AM, ROMAIN, ERICKA W CTR DISA PEO-MA <ericka.romain....@disa.mil> wrote: > I am trying to get Postgres to use SHA as the password hash algorithm instead > of MD5. This is a security requirement. I am running PostgreSQL 8.4 on a Red > Hat Linux platform. I have installed pgcrypto and ran pgcrypto.sql. I also > created a function SHA-256. The function looks like: > > CREATE OR REPLACE FUNCTION sha256(bytea) returns text AS $$ > SELECT encode(digest($1, 'sha256'), 'hex') > $$ LANGUAGE SQL STRICT IMMUTABLE; > > I then created a new user. Then I queried pg_shadow and the encrypted > password still has md5 at the beginning of the hash. How do I get postgres to > use SHA-256?
Well, the function you created has nothing to do with how Postgres handles password authentication. A whole bunch of places in the code are hardcoded to assume that password hashing and authentication are done with MD5, and you'd have to change them all to support SHA-256 password hashing instead. Also, all clients connecting to your server would have to be using your modified version of libpq to authenticate to your modified server. Josh -- Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-admin
