public/postgresql_passchanger_function
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

bugfixes

Browse Source
This commit is contained in:
dodger 2022-05-09 17:56:08 +02:00
parent 8f3c580bb4
commit 270db13e60
Signed by: dodger
GPG Key ID: F6701F6CB4D1C826
4 changed files with 49 additions and 46 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
README.md
View File

@ -5,6 +5,12 @@
This project tries to find a way to allow users the management of the `VALID UNTIL` expiration clause by themself. This project tries to find a way to allow users the management of the `VALID UNTIL` expiration clause by themself.
All without granting `super` permissions and having a histoc of changes on a _pseudo-audit_ table All without granting `super` permissions and having a histoc of changes on a _pseudo-audit_ table
| :warning: WARNING |
|:---------------------------|
| Amazon RDS has its own instructions on README_RDS.md |
|:---------------------------|
| :warning: WARNING |
## Instructions ## Instructions
### First deploy ### First deploy

2
grants_to_grant_rds.sql
View File

@ -5,7 +5,7 @@ grant usage on schema dba to dodger ;
-- grant execute on the function change_my_password -- grant execute on the function change_my_password
grant execute on function dba.change_my_password(text) to dodger; grant execute on function dba.change_my_password(text) to dodger;
-- grant execute on the function change_valid_until -- grant execute on the function change_valid_until
grant execute on function dba.change_valid_until(text) to dodger; grant execute on function dba.change_valid_until(text, text) to dodger;
-- only insert is needed to allow audit trace -- only insert is needed to allow audit trace
GRANT INSERT ON TABLE dba.pwdhistory TO dodger; GRANT INSERT ON TABLE dba.pwdhistory TO dodger;

22
passchanger.sql
View File

@ -49,30 +49,35 @@ AS $BODY$
declare declare
_invokingfunction text := ''; _invokingfunction text := '';
_matches text; _matches text;
_password_lifetime int := 120; -- specify password lifetime --_password_lifetime text := '120 days'; -- specify password lifetime
_retval INTEGER; _retval INTEGER;
_expiration_date text;
begin begin
select now() + interval '120 days' into _expiration_date ;
select query into _invokingfunction from pg_stat_activity where pid = pg_backend_pid() ; select query into _invokingfunction from pg_stat_activity where pid = pg_backend_pid() ;
-- first, checking the invoking function
-- raise notice 'Invoking function: %', _invokingfunction; -- raise notice 'Invoking function: %', _invokingfunction;
--_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i'); --_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i'); _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i');
-- raise notice 'Matches: %', _matches; -- raise notice 'Matches: %', _matches;
if _matches IS NOT NULL then if _matches IS NOT NULL then
-- then checking the regex for the password
EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename); EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename);
return 0; return 0;
_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i'); _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
if _matches IS NOT NULL then if _matches IS NOT NULL then
--EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename); --EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename);
EXECUTE format('ALTER ROLE ''%I'' WITH PASSWORD ''%L'' VALID UNTIL now() + interval ''%I days'' ;', _usename, _thepassword, _password_lifetime) EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL now() + interval ''%I days'' ;', _usename, _thepassword, _password_lifetime);
INTO _retval; -- INTO _retval;
RETURN _retval; RETURN 0;
else else
raise exception 'Regular expresion for password check failed' raise exception 'Regular expresion for password check failed'
using errcode = '22023' -- 22023 = "invalid_parameter_value' using errcode = '22023' -- 22023 = "invalid_parameter_value'
, detail = 'Check your generated password an try again' , detail = 'Check your generated password an try again'
, hint = 'Read the official documentation' ; , hint = 'Read the official documentation' ;
end if; end if;
else -- also catches NULL else
-- also catches NULL
-- raise custom error -- raise custom error
raise exception 'You''re not allowed to run this function directly' raise exception 'You''re not allowed to run this function directly'
using errcode = '22023' -- 22023 = "invalid_parameter_value' using errcode = '22023' -- 22023 = "invalid_parameter_value'
@ -82,11 +87,9 @@ begin
end end
$BODY$; $BODY$;
ALTER FUNCTION dba.change_valid_until(text) ALTER FUNCTION dba.change_valid_until(text) OWNER TO dba;
OWNER TO dba;
REVOKE EXECUTE ON FUNCTION dba.change_valid_until(text) From PUBLIC; REVOKE EXECUTE ON FUNCTION dba.change_valid_until(text) From PUBLIC;
CREATE OR REPLACE FUNCTION dba.change_my_password(_password text) CREATE OR REPLACE FUNCTION dba.change_my_password(_password text)
RETURNS integer RETURNS integer
SECURITY INVOKER SECURITY INVOKER
@ -131,7 +134,6 @@ begin
end end
$BODY$; $BODY$;
ALTER FUNCTION dba.change_my_password(text) ALTER FUNCTION dba.change_my_password(text) OWNER TO dba;
OWNER TO dba;
REVOKE EXECUTE ON FUNCTION dba.change_my_password(text) From PUBLIC; REVOKE EXECUTE ON FUNCTION dba.change_my_password(text) From PUBLIC;

65
passchanger_rds.sql
View File

@ -50,25 +50,25 @@ CREATE OR REPLACE FUNCTION dba.change_valid_until(_usename text, _thepassword te
VOLATILE PARALLEL UNSAFE VOLATILE PARALLEL UNSAFE
AS $BODY$ AS $BODY$
declare declare
_invokingfunction text := ''; _invokingfunction text := '';
_matches text; _matches text;
_password_lifetime int := 120; -- specify password lifetime --_password_lifetime text := '120 days'; -- specify password lifetime
_retval INTEGER; _retval INTEGER;
_expiration_date text; _expiration_date text;
begin begin
select now() + interval '120 days' into _expiration_date ; select now() + interval '120 days' into _expiration_date ;
select query into _invokingfunction from pg_stat_activity where pid = pg_backend_pid() ; select query into _invokingfunction from pg_stat_activity where pid = pg_backend_pid() ;
-- raise notice 'Invoking function: %', _invokingfunction; -- first, checking the invoking function
--_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i'); _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i');
-- raise notice 'Matches: %', _matches; -- raise notice 'Matches: %', _matches;
if _matches IS NOT NULL then if _matches IS NOT NULL then
-- _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i'); -- then checking the regex for the password
_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i'); _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\([[:space:]]{0,}''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''[[:space:]]{0,}\\)[[:space:]]{0,};' , 'i');
-- catch-all regexp, avoid using it
-- _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i');
if _matches IS NOT NULL then if _matches IS NOT NULL then
--EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename); --EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL now() + interval %L days ;', _usename, _thepassword, _password_lifetime);
EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL ''%I'' ;', _usename, _thepassword, _expiration_date); EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL %L ;', _usename, _thepassword, _expiration_date);
--EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL now() + interval ''120 days'' ;', _usename, _thepassword);
-- INTO _retval; -- INTO _retval;
RETURN 0; RETURN 0;
else else
@ -77,7 +77,8 @@ begin
, detail = 'Check your generated password (' || _thepassword || ') an try again' , detail = 'Check your generated password (' || _thepassword || ') an try again'
, hint = 'Read the official documentation' ; , hint = 'Read the official documentation' ;
end if; end if;
else -- also catches NULL else
-- also catches NULL
-- raise custom error -- raise custom error
raise exception 'You''re not allowed to run this function directly' raise exception 'You''re not allowed to run this function directly'
using errcode = '22023' -- 22023 = "invalid_parameter_value' using errcode = '22023' -- 22023 = "invalid_parameter_value'
@ -87,11 +88,9 @@ begin
end end
$BODY$; $BODY$;
-- ALTER FUNCTION dba.change_valid_until(text, text) OWNER TO postgres;
ALTER FUNCTION dba.change_valid_until(text, text) OWNER TO dba; ALTER FUNCTION dba.change_valid_until(text, text) OWNER TO dba;
REVOKE EXECUTE ON FUNCTION dba.change_valid_until(text, text) From PUBLIC; REVOKE EXECUTE ON FUNCTION dba.change_valid_until(text, text) From PUBLIC;
CREATE OR REPLACE FUNCTION dba.change_my_password(_password text) CREATE OR REPLACE FUNCTION dba.change_my_password(_password text)
RETURNS integer RETURNS integer
SECURITY INVOKER SECURITY INVOKER
@ -100,38 +99,34 @@ CREATE OR REPLACE FUNCTION dba.change_my_password(_password text)
VOLATILE PARALLEL UNSAFE VOLATILE PARALLEL UNSAFE
AS $BODY$ AS $BODY$
declare declare
_min_password_length int := 12; -- specify min length here _min_password_length int := 12; -- specify min length here
_usename text := ''; _usename text := '';
_useraddress text := ''; _useraddress text := '';
_userapp text := ''; _userapp text := '';
begin begin
select user into _usename; select user into _usename;
if user = 'postgres' then if user = 'postgres' then
raise exception 'This function should not be run by user postgres' raise exception 'This function should not be run by user postgres'
using errcode = '22024' -- 22023 = "invalid_parameter_value' using errcode = '22024' -- 22023 = "invalid_parameter_value'
, detail = 'Use a named user only.' ; , detail = 'Use a named user only.' ;
end if; end if;
if length(_password) < _min_password_length then if length(_password) < _min_password_length then
-- also catches NULL -- also catches NULL
-- raise custom error -- raise custom error
raise exception 'Password too short!' raise exception 'Password too short!'
using errcode = '22023' -- 22023 = "invalid_parameter_value' using errcode = '22023' -- 22023 = "invalid_parameter_value'
, detail = 'Please check your password.' , detail = 'Please check your password.'
, hint = 'Password must be at least ' || _min_password_length || ' characters.'; , hint = 'Password must be at least ' || _min_password_length || ' characters.';
end if; end if;
select client_addr into _useraddress from pg_stat_activity where pid = pg_backend_pid() ; select client_addr into _useraddress from pg_stat_activity where pid = pg_backend_pid() ;
select application_name into _userapp from pg_stat_activity where pid = pg_backend_pid() ; select application_name into _userapp from pg_stat_activity where pid = pg_backend_pid() ;
PERFORM dba.change_valid_until(_usename, _password) ; PERFORM dba.change_valid_until(_usename, _password) ;
insert into dba.pwdhistory insert into dba.pwdhistory
(usename, usename_addres, application_name, password, changed_on) (usename, usename_addres, application_name, password, changed_on)
values (_usename, _useraddress, _userapp, md5(_password),now()); values (_usename, _useraddress, _userapp, md5(_password),now());
--
--
--
return 0; return 0;
end end