working for rds

must be cleaned

grants_to_grant.sql

@@ -5,8 +5,20 @@ grant usage on schema dba to dodger ;
 -- grant execute on the function change_my_password
 grant execute on function dba.change_my_password(text) to dodger;
 -- grant execute on the function change_valid_until
-grant execute on function dba.change_valid_until(text) to dodger;
+grant execute on function dba.change_valid_until(text, text) to dodger;
 
 -- only insert is needed to allow audit trace
 GRANT INSERT ON TABLE dba.pwdhistory TO dodger;
 
+
+
+-- SET SESSION AUTORIZATION dodger ;
+
+
+
+'tV4{A#&x|P%hKM9*}4a0'
+
+select dba.change_my_password( 'XFF{O>%|<e%_#F$pHqaB' ) ;
+
+
+XFF{O>%|<e%_#F$pHqaB

passchanger.sql

@@ -49,15 +49,29 @@ AS $BODY$
 declare
    _invokingfunction text := '';
    _matches text;
+   _password_lifetime int := 120;  -- specify password lifetime
+   _retval  INTEGER;
 begin
     select query into _invokingfunction from pg_stat_activity where pid = pg_backend_pid() ;
 --     raise notice 'Invoking function: %', _invokingfunction;
-    --_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=){1,100}''\\)[[:space:]]{0,};' , 'i');
+    --_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
-    _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
+    _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i');
 --     raise notice 'Matches: %', _matches;
     if _matches IS NOT NULL then
       EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename);
       return 0;
+        _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
+        if _matches IS NOT NULL then
+            --EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename);
+            EXECUTE format('ALTER ROLE ''%I'' WITH PASSWORD ''%L'' VALID UNTIL now() + interval ''%I days'' ;', _usename, _thepassword, _password_lifetime)
+            INTO _retval;
+            RETURN _retval;
+        else
+            raise exception 'Regular expresion for password check failed'
+            using errcode = '22023'  -- 22023 = "invalid_parameter_value'
+            , detail = 'Check your generated password an try again'
+            , hint = 'Read the official documentation' ;
+        end if;
     else  -- also catches NULL
       -- raise custom error
       raise exception 'You''re not allowed to run this function directly'
@@ -81,35 +95,39 @@ CREATE OR REPLACE FUNCTION dba.change_my_password(_password text)
     VOLATILE PARALLEL UNSAFE
 AS $BODY$
 declare
-   _min_password_length int := 8;  -- specify min length here
+   _min_password_length int := 12;  -- specify min length here
    _usename text := '';
    _useraddress text := '';
    _userapp text := '';
 begin
    select user into _usename;
-   select client_addr into _useraddress from pg_stat_activity where pid = pg_backend_pid() ;
+   if user = 'postgres' then
-   select application_name into _userapp from pg_stat_activity where pid = pg_backend_pid() ;
+      raise exception 'This function should not be run by user postgres'
-   if length(_password) >= _min_password_length then
+      using errcode = '22024'  -- 22023 = "invalid_parameter_value'
-      EXECUTE format('ALTER USER %I WITH PASSWORD %L', _usename, _password);
+          , detail = 'Use a named user only.' ;
-   else  -- also catches NULL
+   end if;
+
+   if length(_password) < _min_password_length then
+      -- also catches NULL
       -- raise custom error
       raise exception 'Password too short!'
       using errcode = '22023'  -- 22023 = "invalid_parameter_value'
           , detail = 'Please check your password.'
           , hint = 'Password must be at least ' || _min_password_length || ' characters.';
    end if;
-   if user = 'postgres' then
-      raise exception 'This function should not be run by user postgres'
-      using errcode = '22024'  -- 22023 = "invalid_parameter_value'
-          , detail = 'Use a named user only.' ;
-   else 
-       insert into dba.pwdhistory
-              (usename, usename_addres, application_name, password, changed_on)
-       values (_usename, _useraddress, _userapp, md5(_password),now());
-       PERFORM dba.change_valid_until(_usename) ;
-   end if;
 
-   return 0;
+   select client_addr into _useraddress from pg_stat_activity where pid = pg_backend_pid() ;
+   select application_name into _userapp from pg_stat_activity where pid = pg_backend_pid() ;
+
+    -- this will be executed by the username invoking this function
+    EXECUTE format('ALTER USER %I WITH PASSWORD %L', _usename, _password);
+
+    PERFORM dba.change_valid_until(_usename) ;
+    insert into dba.pwdhistory
+           (usename, usename_addres, application_name, password, changed_on)
+    values (_usename, _useraddress, _userapp, md5(_password),now());
+
+    return 0;
 end
 $BODY$;
 

passchanger_rds.sql

@@ -8,7 +8,7 @@ create role dba with NOLOGIN NOINHERIT ;
 -- grants for dba
 GRANT rds_superuser TO dba ;
 
-grant select on pg_catalog.pg_authid to dba ;
+-- grant select on pg_catalog.pg_authid to dba ;
 grant pg_read_all_stats to dba ;
 
 
@@ -40,6 +40,8 @@ ALTER TABLE IF EXISTS dba.pwdhistory
 -- ######################################
 -- ######################################
 
+drop function dba.change_valid_until ;
+
 CREATE OR REPLACE FUNCTION dba.change_valid_until(_usename text, _thepassword text)
     RETURNS integer
     SECURITY DEFINER
@@ -52,17 +54,29 @@ declare
    _matches text;
    _password_lifetime int := 120;  -- specify password lifetime
    _retval  INTEGER;
+   _expiration_date text;
 begin
+    select now() + interval '120 days' into _expiration_date ;
     select query into _invokingfunction from pg_stat_activity where pid = pg_backend_pid() ;
 --     raise notice 'Invoking function: %', _invokingfunction;
-    --_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=){1,100}''\\)[[:space:]]{0,};' , 'i');
+    --_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
-    _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
+    _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i');
 --     raise notice 'Matches: %', _matches;
     if _matches IS NOT NULL then
-        --EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename);
+--        _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
-        EXECUTE format('ALTER ROLE ''%I'' WITH PASSWORD ''%L'' VALID UNTIL now() + interval ''%I days'' ;', _usename, _thepassword, _password_lifetime); 
+        _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i');
-        INTO _retval;
+        if _matches IS NOT NULL then
-        return _retval;
+            --EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename);
+            EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL ''%I'' ;', _usename, _thepassword, _expiration_date);
+            --EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL now() + interval ''120 days'' ;', _usename, _thepassword);
+            -- INTO _retval;
+            RETURN 0;
+        else
+            raise exception 'Regular expresion for password check failed'
+            using errcode = '22023'  -- 22023 = "invalid_parameter_value'
+            , detail = 'Check your generated password (' || _thepassword || ') an try again'
+            , hint = 'Read the official documentation' ;
+        end if;
     else  -- also catches NULL
       -- raise custom error
       raise exception 'You''re not allowed to run this function directly'
@@ -73,9 +87,9 @@ begin
 end
 $BODY$;
 
-ALTER FUNCTION dba.change_valid_until(text)
+-- ALTER FUNCTION dba.change_valid_until(text, text) OWNER TO postgres;
-    OWNER TO dba;
+ALTER FUNCTION dba.change_valid_until(text, text) OWNER TO dba;
-REVOKE EXECUTE ON FUNCTION dba.change_valid_until(text) From PUBLIC;
+REVOKE EXECUTE ON FUNCTION dba.change_valid_until(text, text) From PUBLIC;
 
 
 CREATE OR REPLACE FUNCTION dba.change_my_password(_password text)
@@ -86,7 +100,7 @@ CREATE OR REPLACE FUNCTION dba.change_my_password(_password text)
     VOLATILE PARALLEL UNSAFE
 AS $BODY$
 declare
-   _min_password_length int := 8;  -- specify min length here
+   _min_password_length int := 12;  -- specify min length here
    _usename text := '';
    _useraddress text := '';
    _userapp text := '';
@@ -119,31 +133,10 @@ begin
 --
 --
 
-   if length(_password) >= _min_password_length then
+    return 0;
-      EXECUTE format('ALTER USER %I WITH PASSWORD %L', _usename, _password);
-   else  -- also catches NULL
-      -- raise custom error
-      raise exception 'Password too short!'
-      using errcode = '22023'  -- 22023 = "invalid_parameter_value'
-          , detail = 'Please check your password.'
-          , hint = 'Password must be at least ' || _min_password_length || ' characters.';
-   end if;
-   if user = 'postgres' then
-      raise exception 'This function should not be run by user postgres'
-      using errcode = '22024'  -- 22023 = "invalid_parameter_value'
-          , detail = 'Use a named user only.' ;
-   else 
-       insert into dba.pwdhistory
-              (usename, usename_addres, application_name, password, changed_on)
-       values (_usename, _useraddress, _userapp, md5(_password),now());
-       PERFORM dba.change_valid_until(_usename) ;
-   end if;
-
-   return 0;
 end
 $BODY$;
 
-ALTER FUNCTION dba.change_my_password(text)
+ALTER FUNCTION dba.change_my_password(text) OWNER TO dba;
-    OWNER TO dba;
 REVOKE EXECUTE ON FUNCTION dba.change_my_password(text) From PUBLIC;