VAULT-13614 Support SCRAM-SHA-256 encrypted passwords for PostgreSQL #19616

raymonstah · 2023-03-17T18:42:21Z

This PR introduces the ability to encrypt passwords in Vault before sending them to PostgreSQL. Doing so will prevent plaintext passwords from showing up in the PostgreSQL logs.
To enable scram-sha-256 password encryption, set password_encryption when writing the database configuration.

    $ vault write database/config/my-postgresql-database \
        plugin_name="postgresql-database-plugin" \
        allowed_roles="my-role" \
        connection_url="postgresql://{{username}}:{{password}}@localhost:5432/database-name" \
        username="vaultuser" \
        password="vaultpass" \
        password_authentication="scram-sha-256"

It makes use of this library to perform the encryption.

* don't error for other message events Signed-off-by: David van der Spek <[email protected]> * add changelog Signed-off-by: David van der Spek <[email protected]> * rename release note for changelog Signed-off-by: David van der Spek <[email protected]> --------- Signed-off-by: David van der Spek <[email protected]>

* glimmerize alert-banner * structure for the DocLink todo: css important remove * styling done. kind of strange, but should help in future * clean up * test coverage * changelog * address pr comments * clean up * amended language on banner to match most recent change. * add return * clean up * modify the banner title and shorten message * update language

* fix delete not working for ssh config * add test * add changelog;

* bug: correct handling of the zero int64 value * Update changelog/18729.txt --------- Co-authored-by: valli_0x <[email protected]> Co-authored-by: Tom Proctor <[email protected]>

* VAULT-14215 Fix panic for non-TLS listeners during SIGHUP * VAULT-14215 Changelog * VAULT-14215 Godoc for test

* replace use of os.Unsetenv in test with t.Setenv and remove t.Parallel from test that rely on env being modified. * experiment with using fromJSON function * revert previous experiment * including double quotes in the output value for the string ubuntu-latest * use go run to launch gofumpt

…mber challenge (#19497)

* Un-hiding link to 1.13 upgrade guide * Removing draft notice

* sdk: Fix fmt + add FieldType test * Add test comment

* Add support for importing RSA-PSS keys in Transit Signed-off-by: Alexander Scheel <[email protected]> * Add changelog entry Signed-off-by: Alexander Scheel <[email protected]> --------- Signed-off-by: Alexander Scheel <[email protected]>

…19533)

) * fix data race on plugin reload * add changelog * add comment for posterity * revert comment and return assignment in router.go * rework plugin continue on error tests to use compilePlugin * fix race condition on route entry * add test for plugin reload and rollback race detection * add go doc for test

* remove oracle banner * add back extra test coverage for other banner * add description

maxcoulombe

Looks good! Honestly all my comments are cosmetic. Only real question is why did we copy the scram code instead of importing it?

plugins/database/postgresql/postgresql.go

maxcoulombe · 2023-03-20T17:40:11Z

plugins/database/postgresql/postgresql.go

+var (
+	PasswordEncryptionSCRAMSHA256 PasswordEncryption = "scram-sha-256"
+	PasswordEncryptionPlainText   PasswordEncryption = "plaintext"
+)


Would PasswordEncryptionNone PasswordEncryption = "none" be a more appropriate name?
Plaintext encryption sounds a bit funky to me, curious to hear from others.

+1 for PasswordEncryptionNone

plugins/database/postgresql/postgresql.go

maxcoulombe · 2023-03-20T17:54:12Z

plugins/database/postgresql/postgresql.go

@@ -10,6 +10,8 @@ import (
 	"regexp"
 	"strings"

+	"github.com/hashicorp/vault/plugins/database/postgresql/scram"


Curious why we copied to code instead of importing github.com/supercaracal/scram-sha-256?

Unfortunately when I last checked, it wasn't an option since all of the source code was in a main package and un-exported.

Aight, surprised there are no packages that would do what we need but it's simple enough and open sourced so I think copying is fine.

Also, wondering if it would be worthwhile to have the Crypto team take a look?

Sure, tagged @hashicorp/vault-crypto

woops somehow forgot we have our own resident Crypto expert! Thanks for jumping in @swenson !

plugins/database/postgresql/postgresql.go

plugins/database/postgresql/postgresql_test.go

website/content/api-docs/secret/databases/postgresql.mdx

changelog/19616.txt

plugins/database/postgresql/postgresql.go

plugins/database/postgresql/scram/scram.go

swenson · 2023-03-20T20:17:08Z

plugins/database/postgresql/scram/scram.go

+	return h.Sum(nil)
+}
+
+func encryptPassword(rawPassword, salt []byte, iter, keyLen int) string {


This isn't encryption.

Suggested change

func encryptPassword(rawPassword, salt []byte, iter, keyLen int) string {

func hashPassword(rawPassword, salt []byte, iter, keyLen int) string {

Not to bikeshed, I'm fine with hash, but I had some un-submitted comments potentially suggesting crypt here as a name. IIRC, this format that's returned here is the Unix crypt format (man crypt), which is used for password hashing.

plugins/database/postgresql/scram/scram.go

website/content/api-docs/secret/databases/postgresql.mdx

cipherboy · 2023-03-20T20:00:17Z

plugins/database/postgresql/scram/scram.go

+
+func encodeB64(src []byte) (dst []byte) {
+	dst = make([]byte, base64.StdEncoding.EncodedLen(len(src)))
+	base64.StdEncoding.Encode(dst, src)


Out of curiosity, why not just return []byte(base64.StdEncoding.EncodeToString(dst, src))?

oh, most of the source code in this file is copied over from here.

Not opposed to changing it, including handling the errors you mentioned below.

cipherboy · 2023-03-20T20:00:37Z

plugins/database/postgresql/scram/scram.go

+
+func getHMACSum(key, msg []byte) []byte {
+	h := hmac.New(sha256.New, key)
+	_, _ = h.Write(msg)


HMAC and SHA-256 may error with BoringCrypto fwiw.

I believe this mostly occurs with large inputs, which this shouldn't really have in general, but still worth noting.

Good to know. The docs for the functions in the Go standard library say they will "never" return an error.

Yeah, the Go standard library doesn't really document the BoringCrypto behavior from what I've seen, especially since its not officially supported.

swenson

LGTM as far as the scram stuff goes.

swenson · 2023-03-20T23:19:39Z

plugins/database/postgresql/postgresql.go

@@ -77,7 +79,8 @@ func new() *PostgreSQL {
 type PostgreSQL struct {
 	*connutil.SQLConnectionProducer

-	usernameProducer template.StringTemplate
+	usernameProducer   template.StringTemplate
+	PasswordEncryption passwordAuthentication


Not sure if this is used outside of this directory, but would be good to update this to PasswordAuthenticator as well.

website/content/api-docs/secret/databases/postgresql.mdx

maxcoulombe

Looks good! Just a small suggestion left for the doc and 🚢 🇮🇹

Co-authored-by: Max Coulombe <[email protected]>

raymonstah · 2023-03-21T19:14:37Z

This PR addresses #6910

raymonstah added 2 commits March 8, 2023 11:34

scram password hash support

da0d8ae

provide "password_encryption" config

e8db5e5

raymonstah requested a review from yhyakuna as a code owner March 17, 2023 18:42

raymonstah requested review from a team and removed request for a team March 17, 2023 18:42

vercel bot deployed to Preview March 17, 2023 18:43 View deployment

fmt

49bc306

raymonstah added this to the 1.14 milestone Mar 17, 2023

raymonstah and others added 21 commits March 17, 2023 12:03

changelog

72e8096

add test docs

5a54a44

ldaputil: adds comment on available text/template functions (#19469)

e032a37

Delete test-link-rewrites.yml (#19467)

b55c3b2

Change headings to h2 (#19402)

c27026d

UI: fix delete for SSH engine config (#19448)

8185d68

* fix delete not working for ssh config * add test * add changelog;

bug: correct sdk handling of the zero int64 value (#18729)

72c5ce8

* bug: correct handling of the zero int64 value * Update changelog/18729.txt --------- Co-authored-by: valli_0x <[email protected]> Co-authored-by: Tom Proctor <[email protected]>

VAULT-14215 Fix panic for non-TLS listeners during SIGHUP (#19483)

e8f8084

* VAULT-14215 Fix panic for non-TLS listeners during SIGHUP * VAULT-14215 Changelog * VAULT-14215 Godoc for test

Remove the note about Vault not supporting number Okta verify push nu…

139fad6

…mber challenge (#19497)

Add info about gcp service account key encoding (#19496)

e4957d6

Un-hiding link to 1.13 upgrade guide (#19505)

0e8ecd0

* Un-hiding link to 1.13 upgrade guide * Removing draft notice

sdk: Fix fmt + add FieldType test (#19493)

0fb9b15

* sdk: Fix fmt + add FieldType test * Add test comment

Remove .mdx extension from link (#19514)

edef778

change mul and div functions (#19495)

068c146

add comment to explain use of math/rand package in lifetime_watcher (#…

915c245

…19533)

Remove oracle banner (#19532)

aaf2824

* remove oracle banner * add back extra test coverage for other banner * add description

vercel bot deployed to Preview March 17, 2023 20:31 View deployment

raymonstah added 2 commits March 17, 2023 13:34

Merge branch 'main' into raymond/scram-support

cb65677

add scram package to test_packages

3ca59d1

raymonstah marked this pull request as ready for review March 18, 2023 00:53

raymonstah changed the title ~~Support SCRAM-SHA-256 encrypted passwords for PostgreSQL~~ VAULT-13614 Support SCRAM-SHA-256 encrypted passwords for PostgreSQL Mar 20, 2023

maxcoulombe reviewed Mar 20, 2023

View reviewed changes

fairclothjm reviewed Mar 20, 2023

View reviewed changes

changelog/19616.txt Outdated Show resolved Hide resolved

fairclothjm reviewed Mar 20, 2023

View reviewed changes

plugins/database/postgresql/postgresql.go Outdated Show resolved Hide resolved

maxcoulombe reviewed Mar 20, 2023

View reviewed changes

plugins/database/postgresql/postgresql.go Show resolved Hide resolved

add scram package to test_packages

99e2d6e

raymonstah requested a review from a team March 20, 2023 20:19

swenson reviewed Mar 20, 2023

View reviewed changes

raymonstah added 3 commits March 20, 2023 13:20

sort imports

e0f926e

add SCRAM library to copywrite ignore

b998c23

rename from Encrypt to Hash

efe94fd

cipherboy reviewed Mar 20, 2023

View reviewed changes

rename password_encryption to password_authentication

ef287a2

vercel bot had a problem deploying to Preview March 20, 2023 23:12 Failure

swenson approved these changes Mar 20, 2023

View reviewed changes

rename password_encryption to password_authentication (part 2)

ceaba05

maxcoulombe reviewed Mar 21, 2023

View reviewed changes

website/content/api-docs/secret/databases/postgresql.mdx Outdated Show resolved Hide resolved

maxcoulombe approved these changes Mar 21, 2023

View reviewed changes

rename encrypted to hash in docs

aac9e01

Co-authored-by: Max Coulombe <[email protected]>

vercel bot deployed to Preview March 21, 2023 16:26 View deployment

raymonstah merged commit ba963a8 into main Mar 21, 2023

raymonstah mentioned this pull request Mar 21, 2023

PostgreSQL plugin creates roles with password in clear text #6910

Closed

yhyakuna mentioned this pull request Apr 19, 2023

Backport of docs(postgresql): Update Postgresql SE API doco into release/1.13.x #20244

Closed

Pigment-RomainLoisel mentioned this pull request Aug 12, 2024

[Enhancement]: Support "password_authentication" for PostgreSQL backend hashicorp/terraform-provider-vault#2315

Closed

kevineor mentioned this pull request Nov 22, 2024

vault_database_secret_backend_connection: Add support for password_authentication on PostgreSQL hashicorp/terraform-provider-vault#2371

Merged

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

VAULT-13614 Support SCRAM-SHA-256 encrypted passwords for PostgreSQL #19616

VAULT-13614 Support SCRAM-SHA-256 encrypted passwords for PostgreSQL #19616

raymonstah commented Mar 17, 2023 •

edited

Loading

maxcoulombe left a comment

maxcoulombe Mar 20, 2023

fairclothjm Mar 20, 2023

maxcoulombe Mar 20, 2023

raymonstah Mar 20, 2023

maxcoulombe Mar 20, 2023

fairclothjm Mar 20, 2023

raymonstah Mar 20, 2023

fairclothjm Mar 20, 2023

swenson Mar 20, 2023

cipherboy Mar 20, 2023

cipherboy Mar 20, 2023

raymonstah Mar 20, 2023

cipherboy Mar 20, 2023 •

edited

Loading

swenson Mar 20, 2023

cipherboy Mar 20, 2023

swenson left a comment

swenson Mar 20, 2023

maxcoulombe left a comment

raymonstah commented Mar 21, 2023 •

edited

Loading

	func encryptPassword(rawPassword, salt []byte, iter, keyLen int) string {
	func hashPassword(rawPassword, salt []byte, iter, keyLen int) string {

VAULT-13614 Support SCRAM-SHA-256 encrypted passwords for PostgreSQL #19616

VAULT-13614 Support SCRAM-SHA-256 encrypted passwords for PostgreSQL #19616

Conversation

raymonstah commented Mar 17, 2023 • edited Loading

maxcoulombe left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cipherboy Mar 20, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

swenson left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

maxcoulombe left a comment

Choose a reason for hiding this comment

raymonstah commented Mar 21, 2023 • edited Loading

raymonstah commented Mar 17, 2023 •

edited

Loading

cipherboy Mar 20, 2023 •

edited

Loading

raymonstah commented Mar 21, 2023 •

edited

Loading