README.md

@@ -5,11 +5,6 @@
 This project tries to find a way to allow users the management of the `VALID UNTIL` expiration clause by themself.
 All without granting `super` permissions and having a histoc of changes on a _pseudo-audit_ table
 
-| :warning: WARNING          |
-|:---------------------------|
-| Amazon RDS has some notes at the end... |
-| :warning: WARNING          |
-
 ## Instructions
 
 ### First deploy
@@ -48,14 +43,3 @@ dodger@ciberterminal.net $ bash password_creator.sh
 select dba.change_my_password('<Wl}TxqRPBQaV_N<rU#A') ;
 -- ##############################################
 ```
-
-
-## RDS considerations
-
-As Amazon has modified Postgresql so you don't have access as a *real* superuser, the _dangerous_ function
-`change_valid_until` should run as the owner of the database (the user created when you deploy the database through AWS)
-
-There's a `passchanger_rds.sqlp` file which should be used instead of the normal one.
-
-
-

grants_to_grant.sql

@@ -14,3 +14,11 @@ GRANT INSERT ON TABLE dba.pwdhistory TO dodger;
 
 -- SET SESSION AUTORIZATION dodger ;
 
+
+
+'tV4{A#&x|P%hKM9*}4a0'
+
+select dba.change_my_password( 'XFF{O>%|<e%_#F$pHqaB' ) ;
+
+
+XFF{O>%|<e%_#F$pHqaB

grants_to_grant_rds.sql

@@ -0,0 +1,12 @@
+
+-- grant usage for schema dba
+grant usage on schema dba to dodger ;
+
+-- grant execute on the function change_my_password
+grant execute on function dba.change_my_password(text) to dodger;
+-- grant execute on the function change_valid_until
+grant execute on function dba.change_valid_until(text) to dodger;
+
+-- only insert is needed to allow audit trace
+GRANT INSERT ON TABLE dba.pwdhistory TO dodger;
+

passchanger.sql

@@ -49,35 +49,30 @@ AS $BODY$
 declare
    _invokingfunction text := '';
    _matches text;
-    --_password_lifetime text := '120 days';  -- specify password lifetime
+   _password_lifetime int := 120;  -- specify password lifetime
    _retval  INTEGER;
-    _expiration_date text;
 begin
-    select now() + interval '120 days' into _expiration_date ;
     select query into _invokingfunction from pg_stat_activity where pid = pg_backend_pid() ;
-    -- first, checking the invoking function
 --     raise notice 'Invoking function: %', _invokingfunction;
     --_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
     _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i');
 --     raise notice 'Matches: %', _matches;
     if _matches IS NOT NULL then
-        -- then checking the regex for the password
       EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename);
       return 0;
         _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
         if _matches IS NOT NULL then
             --EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename);
-            EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL now() + interval ''%I days'' ;', _usename, _thepassword, _password_lifetime);
+            EXECUTE format('ALTER ROLE ''%I'' WITH PASSWORD ''%L'' VALID UNTIL now() + interval ''%I days'' ;', _usename, _thepassword, _password_lifetime)
-            -- INTO _retval;
+            INTO _retval;
-            RETURN 0;
+            RETURN _retval;
         else
             raise exception 'Regular expresion for password check failed'
             using errcode = '22023'  -- 22023 = "invalid_parameter_value'
             , detail = 'Check your generated password an try again'
             , hint = 'Read the official documentation' ;
         end if;
-    else  
+    else  -- also catches NULL
-      -- also catches NULL
       -- raise custom error
       raise exception 'You''re not allowed to run this function directly'
       using errcode = '22023'  -- 22023 = "invalid_parameter_value'
@@ -87,9 +82,11 @@ begin
 end
 $BODY$;
 
-ALTER FUNCTION dba.change_valid_until(text) OWNER TO dba;
+ALTER FUNCTION dba.change_valid_until(text)
+    OWNER TO dba;
 REVOKE EXECUTE ON FUNCTION dba.change_valid_until(text) From PUBLIC;
 
+
 CREATE OR REPLACE FUNCTION dba.change_my_password(_password text)
     RETURNS integer
     SECURITY INVOKER
@@ -134,6 +131,7 @@ begin
 end
 $BODY$;
 
-ALTER FUNCTION dba.change_my_password(text) OWNER TO dba;
+ALTER FUNCTION dba.change_my_password(text)
+    OWNER TO dba;
 REVOKE EXECUTE ON FUNCTION dba.change_my_password(text) From PUBLIC;
 

passchanger_rds.sql

@@ -11,6 +11,7 @@ GRANT rds_superuser TO dba ;
 -- grant select on pg_catalog.pg_authid to dba ;
 grant pg_read_all_stats to dba ;
 
+
 -- password history table
 CREATE TABLE IF NOT EXISTS dba.pwdhistory
 (
@@ -49,25 +50,25 @@ CREATE OR REPLACE FUNCTION dba.change_valid_until(_usename text, _thepassword te
     VOLATILE PARALLEL UNSAFE
 AS $BODY$
 declare
-    _invokingfunction text := '';
+   _invokingfunction text := '';
-    _matches text;
+   _matches text;
-    --_password_lifetime text := '120 days';  -- specify password lifetime
+   _password_lifetime int := 120;  -- specify password lifetime
-    _retval  INTEGER;
+   _retval  INTEGER;
-    _expiration_date text;
+   _expiration_date text;
 begin
     select now() + interval '120 days' into _expiration_date ;
     select query into _invokingfunction from pg_stat_activity where pid = pg_backend_pid() ;
-    -- first, checking the invoking function
+--     raise notice 'Invoking function: %', _invokingfunction;
+    --_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
     _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i');
 --     raise notice 'Matches: %', _matches;
     if _matches IS NOT NULL then
-        -- then checking the regex for the password
+--        _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
-        _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\([[:space:]]{0,}''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''[[:space:]]{0,}\\)[[:space:]]{0,};' , 'i');
+        _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i');
-        -- catch-all regexp, avoid using it
-        -- _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i');
         if _matches IS NOT NULL then
-            --EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL now() + interval %L days ;', _usename, _thepassword, _password_lifetime);
+            --EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename);
-            EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL %L ;', _usename, _thepassword, _expiration_date);
+            EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL ''%I'' ;', _usename, _thepassword, _expiration_date);
+            --EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL now() + interval ''120 days'' ;', _usename, _thepassword);
             -- INTO _retval;
             RETURN 0;
         else
@@ -76,8 +77,7 @@ begin
             , detail = 'Check your generated password (' || _thepassword || ') an try again'
             , hint = 'Read the official documentation' ;
         end if;
-    else  
+    else  -- also catches NULL
-      -- also catches NULL
       -- raise custom error
       raise exception 'You''re not allowed to run this function directly'
       using errcode = '22023'  -- 22023 = "invalid_parameter_value'
@@ -87,9 +87,11 @@ begin
 end
 $BODY$;
 
--- ALTER FUNCTION dba.change_valid_until(text, text) OWNER TO dba;
+-- ALTER FUNCTION dba.change_valid_until(text, text) OWNER TO postgres;
+ALTER FUNCTION dba.change_valid_until(text, text) OWNER TO dba;
 REVOKE EXECUTE ON FUNCTION dba.change_valid_until(text, text) From PUBLIC;
 
+
 CREATE OR REPLACE FUNCTION dba.change_my_password(_password text)
     RETURNS integer
     SECURITY INVOKER
@@ -98,34 +100,38 @@ CREATE OR REPLACE FUNCTION dba.change_my_password(_password text)
     VOLATILE PARALLEL UNSAFE
 AS $BODY$
 declare
-    _min_password_length int := 12;  -- specify min length here
+   _min_password_length int := 12;  -- specify min length here
-    _usename text := '';
+   _usename text := '';
-    _useraddress text := '';
+   _useraddress text := '';
-    _userapp text := '';
+   _userapp text := '';
 begin
-    select user into _usename;
+   select user into _usename;
-    if user = 'postgres' then
+   if user = 'postgres' then
-        raise exception 'This function should not be run by user postgres'
+      raise exception 'This function should not be run by user postgres'
-        using errcode = '22024'  -- 22023 = "invalid_parameter_value'
+      using errcode = '22024'  -- 22023 = "invalid_parameter_value'
           , detail = 'Use a named user only.' ;
-    end if;
+   end if;
 
-    if length(_password) < _min_password_length then
+   if length(_password) < _min_password_length then
       -- also catches NULL
       -- raise custom error
       raise exception 'Password too short!'
       using errcode = '22023'  -- 22023 = "invalid_parameter_value'
           , detail = 'Please check your password.'
           , hint = 'Password must be at least ' || _min_password_length || ' characters.';
-    end if;
+   end if;
 
-    select client_addr into _useraddress from pg_stat_activity where pid = pg_backend_pid() ;
+   select client_addr into _useraddress from pg_stat_activity where pid = pg_backend_pid() ;
-    select application_name into _userapp from pg_stat_activity where pid = pg_backend_pid() ;
+   select application_name into _userapp from pg_stat_activity where pid = pg_backend_pid() ;
 
-    PERFORM dba.change_valid_until(_usename, _password) ;
+   PERFORM dba.change_valid_until(_usename, _password) ;
-    insert into dba.pwdhistory
+   insert into dba.pwdhistory
           (usename, usename_addres, application_name, password, changed_on)
-    values (_usename, _useraddress, _userapp, md5(_password),now());
+   values (_usename, _useraddress, _userapp, md5(_password),now());
+
+--
+--
+--
 
     return 0;
 end