public/postgresql_passchanger_function
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

working for rds

Browse Source 
must be cleaned
This commit is contained in:
dodger 2022-05-06 17:52:04 +02:00
parent 3ec8411acc
commit 8f3c580bb4
Signed by: dodger
GPG Key ID: F6701F6CB4D1C826
3 changed files with 77 additions and 54 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
grants_to_grant.sql
View File

@ -5,8 +5,20 @@ grant usage on schema dba to dodger ;
-- grant execute on the function change_my_password
grant execute on function dba.change_my_password(text) to dodger;
-- grant execute on the function change_valid_until
grant execute on function dba.change_valid_until(text) to dodger;
grant execute on function dba.change_valid_until(text, text) to dodger;
-- only insert is needed to allow audit trace
GRANT INSERT ON TABLE dba.pwdhistory TO dodger;
-- SET SESSION AUTORIZATION dodger ;
'tV4{A#&x|P%hKM9*}4a0'
select dba.change_my_password( 'XFF{O>%|<e%_#F$pHqaB' ) ;
XFF{O>%|<e%_#F$pHqaB

56
passchanger.sql
View File

@ -49,15 +49,29 @@ AS $BODY$
declare
_invokingfunction text := '';
_matches text;
_password_lifetime int := 120; -- specify password lifetime
_retval INTEGER;
begin
select query into _invokingfunction from pg_stat_activity where pid = pg_backend_pid() ;
-- raise notice 'Invoking function: %', _invokingfunction;
--_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=){1,100}''\\)[[:space:]]{0,};' , 'i');
_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
--_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i');
-- raise notice 'Matches: %', _matches;
if _matches IS NOT NULL then
EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename);
return 0;
_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
if _matches IS NOT NULL then
--EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename);
EXECUTE format('ALTER ROLE ''%I'' WITH PASSWORD ''%L'' VALID UNTIL now() + interval ''%I days'' ;', _usename, _thepassword, _password_lifetime)
INTO _retval;
RETURN _retval;
else
raise exception 'Regular expresion for password check failed'
using errcode = '22023' -- 22023 = "invalid_parameter_value'
, detail = 'Check your generated password an try again'
, hint = 'Read the official documentation' ;
end if;
else -- also catches NULL
-- raise custom error
raise exception 'You''re not allowed to run this function directly'
@ -81,35 +95,39 @@ CREATE OR REPLACE FUNCTION dba.change_my_password(_password text)
VOLATILE PARALLEL UNSAFE
AS $BODY$
declare
_min_password_length int := 8; -- specify min length here
_min_password_length int := 12; -- specify min length here
_usename text := '';
_useraddress text := '';
_userapp text := '';
begin
select user into _usename;
select client_addr into _useraddress from pg_stat_activity where pid = pg_backend_pid() ;
select application_name into _userapp from pg_stat_activity where pid = pg_backend_pid() ;
if length(_password) >= _min_password_length then
EXECUTE format('ALTER USER %I WITH PASSWORD %L', _usename, _password);
else -- also catches NULL
if user = 'postgres' then
raise exception 'This function should not be run by user postgres'
using errcode = '22024' -- 22023 = "invalid_parameter_value'
, detail = 'Use a named user only.' ;
end if;
if length(_password) < _min_password_length then
-- also catches NULL
-- raise custom error
raise exception 'Password too short!'
using errcode = '22023' -- 22023 = "invalid_parameter_value'
, detail = 'Please check your password.'
, hint = 'Password must be at least ' || _min_password_length || ' characters.';
end if;
if user = 'postgres' then
raise exception 'This function should not be run by user postgres'
using errcode = '22024' -- 22023 = "invalid_parameter_value'
, detail = 'Use a named user only.' ;
else
insert into dba.pwdhistory
(usename, usename_addres, application_name, password, changed_on)
values (_usename, _useraddress, _userapp, md5(_password),now());
PERFORM dba.change_valid_until(_usename) ;
end if;
return 0;
select client_addr into _useraddress from pg_stat_activity where pid = pg_backend_pid() ;
select application_name into _userapp from pg_stat_activity where pid = pg_backend_pid() ;
-- this will be executed by the username invoking this function
EXECUTE format('ALTER USER %I WITH PASSWORD %L', _usename, _password);
PERFORM dba.change_valid_until(_usename) ;
insert into dba.pwdhistory
(usename, usename_addres, application_name, password, changed_on)
values (_usename, _useraddress, _userapp, md5(_password),now());
return 0;
end
$BODY$;

61
passchanger_rds.sql
View File

@ -8,7 +8,7 @@ create role dba with NOLOGIN NOINHERIT ;
-- grants for dba
GRANT rds_superuser TO dba ;
grant select on pg_catalog.pg_authid to dba ;
-- grant select on pg_catalog.pg_authid to dba ;
grant pg_read_all_stats to dba ;
@ -40,6 +40,8 @@ ALTER TABLE IF EXISTS dba.pwdhistory
-- ######################################
-- ######################################
drop function dba.change_valid_until ;
CREATE OR REPLACE FUNCTION dba.change_valid_until(_usename text, _thepassword text)
RETURNS integer
SECURITY DEFINER
@ -52,17 +54,29 @@ declare
_matches text;
_password_lifetime int := 120; -- specify password lifetime
_retval INTEGER;
_expiration_date text;
begin
select now() + interval '120 days' into _expiration_date ;
select query into _invokingfunction from pg_stat_activity where pid = pg_backend_pid() ;
-- raise notice 'Invoking function: %', _invokingfunction;
--_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=){1,100}''\\)[[:space:]]{0,};' , 'i');
_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
--_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i');
-- raise notice 'Matches: %', _matches;
if _matches IS NOT NULL then
--EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename);
EXECUTE format('ALTER ROLE ''%I'' WITH PASSWORD ''%L'' VALID UNTIL now() + interval ''%I days'' ;', _usename, _thepassword, _password_lifetime);
INTO _retval;
return _retval;
-- _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i');
if _matches IS NOT NULL then
--EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename);
EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL ''%I'' ;', _usename, _thepassword, _expiration_date);
--EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL now() + interval ''120 days'' ;', _usename, _thepassword);
-- INTO _retval;
RETURN 0;
else
raise exception 'Regular expresion for password check failed'
using errcode = '22023' -- 22023 = "invalid_parameter_value'
, detail = 'Check your generated password (' || _thepassword || ') an try again'
, hint = 'Read the official documentation' ;
end if;
else -- also catches NULL
-- raise custom error
raise exception 'You''re not allowed to run this function directly'
@ -73,9 +87,9 @@ begin
end
$BODY$;
ALTER FUNCTION dba.change_valid_until(text)
OWNER TO dba;
REVOKE EXECUTE ON FUNCTION dba.change_valid_until(text) From PUBLIC;
-- ALTER FUNCTION dba.change_valid_until(text, text) OWNER TO postgres;
ALTER FUNCTION dba.change_valid_until(text, text) OWNER TO dba;
REVOKE EXECUTE ON FUNCTION dba.change_valid_until(text, text) From PUBLIC;
CREATE OR REPLACE FUNCTION dba.change_my_password(_password text)
@ -86,7 +100,7 @@ CREATE OR REPLACE FUNCTION dba.change_my_password(_password text)
VOLATILE PARALLEL UNSAFE
AS $BODY$
declare
_min_password_length int := 8; -- specify min length here
_min_password_length int := 12; -- specify min length here
_usename text := '';
_useraddress text := '';
_userapp text := '';
@ -119,31 +133,10 @@ begin
--
--
if length(_password) >= _min_password_length then
EXECUTE format('ALTER USER %I WITH PASSWORD %L', _usename, _password);
else -- also catches NULL
-- raise custom error
raise exception 'Password too short!'
using errcode = '22023' -- 22023 = "invalid_parameter_value'
, detail = 'Please check your password.'
, hint = 'Password must be at least ' || _min_password_length || ' characters.';
end if;
if user = 'postgres' then
raise exception 'This function should not be run by user postgres'
using errcode = '22024' -- 22023 = "invalid_parameter_value'
, detail = 'Use a named user only.' ;
else
insert into dba.pwdhistory
(usename, usename_addres, application_name, password, changed_on)
values (_usename, _useraddress, _userapp, md5(_password),now());
PERFORM dba.change_valid_until(_usename) ;
end if;
return 0;
return 0;
end
$BODY$;
ALTER FUNCTION dba.change_my_password(text)
OWNER TO dba;
ALTER FUNCTION dba.change_my_password(text) OWNER TO dba;
REVOKE EXECUTE ON FUNCTION dba.change_my_password(text) From PUBLIC;