PostgreSQL md5 auth method introduce, with random salt protect

在上一篇BLOG中介绍了不要在pg_hba.conf中使用password认证方法, 除非你的客户端和数据库服务器之间的网络是绝对安全的.

http://blog.163.com/digoal@126/blog/static/1638770402013423102431541/

MD5方法,认证过程 :

Encrypting Passwords Across A Network
The MD5 authentication method double-encrypts the password on the client before sending it to the server. It first MD5-encrypts it based on the user name, and then encrypts it based on a random salt sent by the server when the database connection was made. It is this double-encrypted value that is sent over the network to the server. Double-encryption not only prevents the password from being discovered, it also prevents another connection from using the same encrypted password to connect to the database server at a later time.

数据库服务器给客户端连接进程发送认证请求包 :

src/backend/libpq/auth.c

/** Send an authentication request packet to the frontend.*/
static void
sendAuthRequest(Port *port, AuthRequest areq)
{StringInfoData buf;pq_beginmessage(&buf, 'R');pq_sendint(&buf, (int32) areq, sizeof(int32));/* Add the salt for encrypted passwords. */if (areq == AUTH_REQ_MD5)pq_sendbytes(&buf, port->md5Salt, 4);#if defined(ENABLE_GSS) || defined(ENABLE_SSPI)/** Add the authentication data for the next step of the GSSAPI or SSPI* negotiation.*/else if (areq == AUTH_REQ_GSS_CONT){if (port->gss->outbuf.length > 0){elog(DEBUG4, "sending GSS token of length %u",(unsigned int) port->gss->outbuf.length);pq_sendbytes(&buf, port->gss->outbuf.value, port->gss->outbuf.length);}}
#endifpq_endmessage(&buf);/** Flush message so client will see it, except for AUTH_REQ_OK, which need* not be sent until we are ready for queries.*/if (areq != AUTH_REQ_OK)pq_flush();
}

服务端接收到客户端发过来的经过salt和原密码md5合成后的md5, 校验是否正确.

src/backend/libpq/crypt.c

 * crypt.c*        Look into the password file and check the encrypted password with*        the one passed in from the frontend.
int
md5_crypt_verify(const Port *port, const char *role, char *client_pass)
{int                     retval = STATUS_ERROR;char       *shadow_pass,*crypt_pwd;
... 略./** Compare with the encrypted or plain password depending on the* authentication method being used for this connection.*/switch (port->hba->auth_method){case uaMD5:crypt_pwd = palloc(MD5_PASSWD_LEN + 1);if (isMD5(shadow_pass)){/* stored password already encrypted, only do salt */if (!pg_md5_encrypt(shadow_pass + strlen("md5"),port->md5Salt,sizeof(port->md5Salt), crypt_pwd)){pfree(crypt_pwd);return STATUS_ERROR;}}else{/* stored password is plain, double-encrypt */char       *crypt_pwd2 = palloc(MD5_PASSWD_LEN + 1);if (!pg_md5_encrypt(shadow_pass,port->user_name,strlen(port->user_name),crypt_pwd2)){pfree(crypt_pwd);pfree(crypt_pwd2);return STATUS_ERROR;}if (!pg_md5_encrypt(crypt_pwd2 + strlen("md5"),port->md5Salt,sizeof(port->md5Salt),crypt_pwd)){pfree(crypt_pwd);pfree(crypt_pwd2);return STATUS_ERROR;}pfree(crypt_pwd2);}break;
... 略.

[参考]

1. src/backend/libpq/auth.c

2. src/backend/libpq/crypt.c

3. http://www.postgresql.org/docs/9.3/static/protocol-flow.html

4. http://www.postgresql.org/docs/9.3/static/encryption-options.html

5. http://blog.163.com/digoal@126/blog/static/1638770402013423102431541/

PostgreSQL md5 auth method introduce, with random salt protect相关推荐

vagrant up 命令 ssh auth method:private key 卡住问题的解决方法
执行 vagrant up 命令,卡在 ssh auth method:private key: 最后提示 Timed out: (1)原因分析之前的 VirtualBox 版本比较旧,与最新版的 ...
论文《An improved spatiotemporal correlation method for high-accuracy random speckle 3D reconstruct》学习
Abstract (2018SCI一区)单镜头随机散斑图方法可用于动态场景三维重建.然而,基于空间相关的同名点搜索过程对投影.透视.曲率等因素的变化非常敏感,导致重建精度较低.提出了一种改进的随机散斑 ...
java.securti_springboot集成springsecurity 使用OAUTH2做权限管理的教程
Spring Security OAuth2 主要配置,注意application.yml最后的配置resource filter顺序配置,不然会能获取token但是访问一直没有权限 WebSecu ...
wordpress phpass java版本
phpass的java版本:https://github.com/Wolf480pl/PHPass 对于wordpress的加密密码验证通过. 主要的加密处理文件:phpass.java /** Co ...
springboot集成springsecurity 使用OAUTH2做权限管理
Spring Security OAuth2 主要配置,注意application.yml最后的配置resource filter顺序配置,不然会能获取token但是访问一直没有权限 WebSecu ...
yii2框架_选择Yii 2框架的7个理由
yii2框架 Late last year, SitePoint published an article highlighting the top PHP frameworks. Tied for ...
浅谈BCrypt密码加解密的使用
一.编写核心类BCrypt.java // Copyright (c) 2006 Damien Miller <djm@mindrot.org> // // Permission to u ...
BCryptPasswordEncoder 对密码加密
工具 package com.bypx.housing.demo;// Copyright (c) 2006 Damien Miller <djm@mindrot.org> // // P ...
MD5算法与Salt
文章目录 2.6.MD5算法与Salt MD5算法的作用和特点 Salt 注册,登录流程实现对密码使用MD5+Slat,并进行hash加密自定义realm实现在用户登录的时候进行比对 2.6.M ...

PostgreSQL md5 auth method introduce, with random salt protect

PostgreSQL md5 auth method introduce, with random salt protect相关推荐

最新文章

热门文章