<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
On 3/29/23 09:52, Todd Stein wrote:<br>
<blockquote type="cite"
cite="mid:BN8PR18MB3027EA4374E11DD143DBC0EDF3899@BN8PR18MB3027.namprd18.prod.outlook.com">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style>@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;
mso-fareast-language:EN-US;}span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;
mso-fareast-language:EN-US;}div.WordSection1
{page:WordSection1;}</style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal">Will someone please correct or confirm my
assumption of the SCRAM-SHA-256 password file format for
$HOME/.pgpass and $HOME/.pcppass files?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’m not sure if I should be using the
password with the AES prefix outside of the pool_password file
or not. For example in the .pgpass and/or .pcppass files.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">$ pg_enc -k ~/.pgpoolkey -u postgres -p<o:p></o:p></p>
<p class="MsoNormal">db password:<o:p></o:p></p>
<p class="MsoNormal">trying to read key from file
/var/lib/pgsql/.pgpoolkey<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b>P1+l8j3GaTxzSBgcY1laEQ==<o:p></o:p></b></p>
<p class="MsoNormal">pool_passwd string: <b>AESP1+l8j3GaTxzSBgcY1laEQ==<o:p></o:p></b></p>
<p class="MsoNormal"><b><o:p> </o:p></b></p>
<p class="MsoNormal">My understanding (please correct me if I’m
wrong), is that the pcp.conf file must use md5 encryption
regardless of what your password_encryption in the DB is.</p>
</div>
</blockquote>
<br>
pcp is for managing PgPool.<br>
<br>
<blockquote type="cite"
cite="mid:BN8PR18MB3027EA4374E11DD143DBC0EDF3899@BN8PR18MB3027.namprd18.prod.outlook.com">
<div class="WordSection1">
<p class="MsoNormal"> The pool_password file (when using
scram-sha-256 encryption) requires the string it gets
automatically (which includes the AES prefix) by the pg_enc
command when providing the “-m” attribute.<o:p></o:p></p>
</div>
</blockquote>
<br>
pool_passwd is for accessing Postgresql databases. <o:p>Their
"user lists" are completely separate. You can, for example, have
user "blarge" in pcp.conf but not in pool_passwd (and by extension
be a Postgresql role).<br>
</o:p>
<blockquote type="cite"
cite="mid:BN8PR18MB3027EA4374E11DD143DBC0EDF3899@BN8PR18MB3027.namprd18.prod.outlook.com">
<div class="WordSection1">
<p class="MsoNormal">However, I’ve not been able to find
anything documented for the password files.</p>
</div>
</blockquote>
<br>
What do you mean?
<a class="moz-txt-link-freetext" href="https://www.pgpool.net/docs/43/en/html/auth-methods.html">https://www.pgpool.net/docs/43/en/html/auth-methods.html</a> describes
pool_passwd, and describes how to create MD5 and SHA256 hashes.<br>
<br>
<blockquote type="cite"
cite="mid:BN8PR18MB3027EA4374E11DD143DBC0EDF3899@BN8PR18MB3027.namprd18.prod.outlook.com">
<div class="WordSection1">
<p class="MsoNormal"> I’m pretty sure I’ve seen that if I were
to use an encrypted password (scram-sha-256) in the
pgpool.conf file, it must include the AES prefix.
<o:p></o:p></p>
</div>
</blockquote>
<br>
pg_enc does that for you.<br>
<br>
<blockquote type="cite"
cite="mid:BN8PR18MB3027EA4374E11DD143DBC0EDF3899@BN8PR18MB3027.namprd18.prod.outlook.com">
<div class="WordSection1">
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">In my testing I find that if the password
in ~/.pgpass includes the AES prefix in the encrypted
password, I get password authentication failed for user
“postgres” when the system tries to start a replication slot.</p>
</div>
</blockquote>
<br>
That needs more detail.<br>
<br>
<div class="moz-signature">-- <br>
Born in Arizona, moved to Babylonia.</div>
</body>
</html>