diff --git a/README.md b/README.md index 0eab8b6..e7a4874 100644 --- a/README.md +++ b/README.md @@ -5,6 +5,12 @@ This project tries to find a way to allow users the management of the `VALID UNTIL` expiration clause by themself. All without granting `super` permissions and having a histoc of changes on a _pseudo-audit_ table +| :warning: WARNING | +|:---------------------------| +| Amazon RDS has its own instructions on README_RDS.md | +|:---------------------------| +| :warning: WARNING | + ## Instructions ### First deploy diff --git a/grants_to_grant_rds.sql b/grants_to_grant_rds.sql index f3916b9..22b2d3e 100644 --- a/grants_to_grant_rds.sql +++ b/grants_to_grant_rds.sql @@ -5,7 +5,7 @@ grant usage on schema dba to dodger ; -- grant execute on the function change_my_password grant execute on function dba.change_my_password(text) to dodger; -- grant execute on the function change_valid_until -grant execute on function dba.change_valid_until(text) to dodger; +grant execute on function dba.change_valid_until(text, text) to dodger; -- only insert is needed to allow audit trace GRANT INSERT ON TABLE dba.pwdhistory TO dodger; diff --git a/passchanger.sql b/passchanger.sql index 78ea121..32b5ba1 100644 --- a/passchanger.sql +++ b/passchanger.sql @@ -49,30 +49,35 @@ AS $BODY$ declare _invokingfunction text := ''; _matches text; - _password_lifetime int := 120; -- specify password lifetime + --_password_lifetime text := '120 days'; -- specify password lifetime _retval INTEGER; + _expiration_date text; begin + select now() + interval '120 days' into _expiration_date ; select query into _invokingfunction from pg_stat_activity where pid = pg_backend_pid() ; + -- first, checking the invoking function -- raise notice 'Invoking function: %', _invokingfunction; --_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i'); _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i'); -- raise notice 'Matches: %', _matches; if _matches IS NOT NULL then + -- then checking the regex for the password EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename); return 0; _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i'); if _matches IS NOT NULL then --EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename); - EXECUTE format('ALTER ROLE ''%I'' WITH PASSWORD ''%L'' VALID UNTIL now() + interval ''%I days'' ;', _usename, _thepassword, _password_lifetime) - INTO _retval; - RETURN _retval; + EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL now() + interval ''%I days'' ;', _usename, _thepassword, _password_lifetime); + -- INTO _retval; + RETURN 0; else raise exception 'Regular expresion for password check failed' using errcode = '22023' -- 22023 = "invalid_parameter_value' , detail = 'Check your generated password an try again' , hint = 'Read the official documentation' ; end if; - else -- also catches NULL + else + -- also catches NULL -- raise custom error raise exception 'You''re not allowed to run this function directly' using errcode = '22023' -- 22023 = "invalid_parameter_value' @@ -82,11 +87,9 @@ begin end $BODY$; -ALTER FUNCTION dba.change_valid_until(text) - OWNER TO dba; +ALTER FUNCTION dba.change_valid_until(text) OWNER TO dba; REVOKE EXECUTE ON FUNCTION dba.change_valid_until(text) From PUBLIC; - CREATE OR REPLACE FUNCTION dba.change_my_password(_password text) RETURNS integer SECURITY INVOKER @@ -131,7 +134,6 @@ begin end $BODY$; -ALTER FUNCTION dba.change_my_password(text) - OWNER TO dba; +ALTER FUNCTION dba.change_my_password(text) OWNER TO dba; REVOKE EXECUTE ON FUNCTION dba.change_my_password(text) From PUBLIC; diff --git a/passchanger_rds.sql b/passchanger_rds.sql index 79b9453..9eb6645 100644 --- a/passchanger_rds.sql +++ b/passchanger_rds.sql @@ -50,25 +50,25 @@ CREATE OR REPLACE FUNCTION dba.change_valid_until(_usename text, _thepassword te VOLATILE PARALLEL UNSAFE AS $BODY$ declare - _invokingfunction text := ''; - _matches text; - _password_lifetime int := 120; -- specify password lifetime - _retval INTEGER; - _expiration_date text; + _invokingfunction text := ''; + _matches text; + --_password_lifetime text := '120 days'; -- specify password lifetime + _retval INTEGER; + _expiration_date text; begin select now() + interval '120 days' into _expiration_date ; select query into _invokingfunction from pg_stat_activity where pid = pg_backend_pid() ; --- raise notice 'Invoking function: %', _invokingfunction; - --_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i'); + -- first, checking the invoking function _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i'); -- raise notice 'Matches: %', _matches; if _matches IS NOT NULL then --- _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i'); - _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i'); + -- then checking the regex for the password + _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\([[:space:]]{0,}''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''[[:space:]]{0,}\\)[[:space:]]{0,};' , 'i'); + -- catch-all regexp, avoid using it + -- _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i'); if _matches IS NOT NULL then - --EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename); - EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL ''%I'' ;', _usename, _thepassword, _expiration_date); - --EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL now() + interval ''120 days'' ;', _usename, _thepassword); + --EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL now() + interval %L days ;', _usename, _thepassword, _password_lifetime); + EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL %L ;', _usename, _thepassword, _expiration_date); -- INTO _retval; RETURN 0; else @@ -77,7 +77,8 @@ begin , detail = 'Check your generated password (' || _thepassword || ') an try again' , hint = 'Read the official documentation' ; end if; - else -- also catches NULL + else + -- also catches NULL -- raise custom error raise exception 'You''re not allowed to run this function directly' using errcode = '22023' -- 22023 = "invalid_parameter_value' @@ -87,11 +88,9 @@ begin end $BODY$; --- ALTER FUNCTION dba.change_valid_until(text, text) OWNER TO postgres; ALTER FUNCTION dba.change_valid_until(text, text) OWNER TO dba; REVOKE EXECUTE ON FUNCTION dba.change_valid_until(text, text) From PUBLIC; - CREATE OR REPLACE FUNCTION dba.change_my_password(_password text) RETURNS integer SECURITY INVOKER @@ -100,38 +99,34 @@ CREATE OR REPLACE FUNCTION dba.change_my_password(_password text) VOLATILE PARALLEL UNSAFE AS $BODY$ declare - _min_password_length int := 12; -- specify min length here - _usename text := ''; - _useraddress text := ''; - _userapp text := ''; + _min_password_length int := 12; -- specify min length here + _usename text := ''; + _useraddress text := ''; + _userapp text := ''; begin - select user into _usename; - if user = 'postgres' then - raise exception 'This function should not be run by user postgres' - using errcode = '22024' -- 22023 = "invalid_parameter_value' + select user into _usename; + if user = 'postgres' then + raise exception 'This function should not be run by user postgres' + using errcode = '22024' -- 22023 = "invalid_parameter_value' , detail = 'Use a named user only.' ; - end if; + end if; - if length(_password) < _min_password_length then + if length(_password) < _min_password_length then -- also catches NULL -- raise custom error raise exception 'Password too short!' using errcode = '22023' -- 22023 = "invalid_parameter_value' , detail = 'Please check your password.' , hint = 'Password must be at least ' || _min_password_length || ' characters.'; - end if; + end if; - select client_addr into _useraddress from pg_stat_activity where pid = pg_backend_pid() ; - select application_name into _userapp from pg_stat_activity where pid = pg_backend_pid() ; + select client_addr into _useraddress from pg_stat_activity where pid = pg_backend_pid() ; + select application_name into _userapp from pg_stat_activity where pid = pg_backend_pid() ; - PERFORM dba.change_valid_until(_usename, _password) ; - insert into dba.pwdhistory + PERFORM dba.change_valid_until(_usename, _password) ; + insert into dba.pwdhistory (usename, usename_addres, application_name, password, changed_on) - values (_usename, _useraddress, _userapp, md5(_password),now()); - --- --- --- + values (_usename, _useraddress, _userapp, md5(_password),now()); return 0; end