Re: Postgresql security checks

On 1 September 2010 16:17, Josh Kupershmidt <schmiddy(at)gmail(dot)com> wrote:
> On Wed, Sep 1, 2010 at 5:02 AM, Thom Brown <thom(at)linux(dot)com> wrote:
>
>> SELECT usename
>> FROM pg_shadow
>> WHERE passwd = 'md5' || md5(usename)
>> OR passwd = 'md5' || md5('company_password');
>
> I think this query should be:
>
>  SELECT usename
>    FROM pg_shadow
>    WHERE passwd = 'md5' || md5(usename || usename) OR
>                   passwd = 'md5' || md5('company_password' || usename);
>
> Since the md5 passwords in pg_shadow (and pg_authid) are created as:
>  MD5(password || username)
>
> By the way, the documentation pages for pg_authid and pg_shadow don't
> mention that md5 passwords are stored in this fashion, perhaps they
> should? Or is this fact documented somewhere else I'm not seeing?

Yes, I had discovered this previously but obviously I've got a memory
leak. Actually, doesn't this apply to roles too?

SELECT rolname
FROM pg_authid
WHERE rolpassword = 'md5' || md5(rolname || rolname) OR
rolpassword = 'md5' || md5('company_password' || rolname);

--
Thom Brown
Twitter: @darkixion
IRC (freenode): dark_ixion
Registered Linux user: #516935