public/postgresql_passchanger_function
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Compare commits

base: public:3d8b1bd3d93fb23b92d88f35e0a09e07d2f22e31
Branches Tags
public:master
..
compare: public:8f3c580bb4e83f36971076842b6228c81c610a86
Branches Tags
public:master

No commits in common. "3d8b1bd3d93fb23b92d88f35e0a09e07d2f22e31" and "8f3c580bb4e83f36971076842b6228c81c610a86" have entirely different histories.
3d8b1bd3d9 ... 8f3c580bb4

5 changed files with 67 additions and 59 deletions
Show Stats Expand all files Collapse all files

16
README.md
View File

@ -5,11 +5,6 @@
This project tries to find a way to allow users the management of the `VALID UNTIL` expiration clause by themself.
All without granting `super` permissions and having a histoc of changes on a _pseudo-audit_ table
| :warning: WARNING |
|:---------------------------|
| Amazon RDS has some notes at the end... |
| :warning: WARNING |
## Instructions
### First deploy
@ -48,14 +43,3 @@ dodger@ciberterminal.net $ bash password_creator.sh
select dba.change_my_password('<Wl}TxqRPBQaV_N<rU#A') ;
-- ##############################################
```
## RDS considerations
As Amazon has modified Postgresql so you don't have access as a *real* superuser, the _dangerous_ function
`change_valid_until` should run as the owner of the database (the user created when you deploy the database through AWS)
There's a `passchanger_rds.sqlp` file which should be used instead of the normal one.

8
grants_to_grant.sql
View File

@ -14,3 +14,11 @@ GRANT INSERT ON TABLE dba.pwdhistory TO dodger;
-- SET SESSION AUTORIZATION dodger ;
'tV4{A#&x|P%hKM9*}4a0'
select dba.change_my_password( 'XFF{O>%|<e%_#F$pHqaB' ) ;
XFF{O>%|<e%_#F$pHqaB

12
grants_to_grant_rds.sql Normal file
View File

@ -0,0 +1,12 @@
-- grant usage for schema dba
grant usage on schema dba to dodger ;
-- grant execute on the function change_my_password
grant execute on function dba.change_my_password(text) to dodger;
-- grant execute on the function change_valid_until
grant execute on function dba.change_valid_until(text) to dodger;
-- only insert is needed to allow audit trace
GRANT INSERT ON TABLE dba.pwdhistory TO dodger;

22
passchanger.sql
View File

@ -49,35 +49,30 @@ AS $BODY$
declare
_invokingfunction text := '';
_matches text;
--_password_lifetime text := '120 days'; -- specify password lifetime
_password_lifetime int := 120; -- specify password lifetime
_retval INTEGER;
_expiration_date text;
begin
select now() + interval '120 days' into _expiration_date ;
select query into _invokingfunction from pg_stat_activity where pid = pg_backend_pid() ;
-- first, checking the invoking function
-- raise notice 'Invoking function: %', _invokingfunction;
--_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i');
-- raise notice 'Matches: %', _matches;
if _matches IS NOT NULL then
-- then checking the regex for the password
EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename);
return 0;
_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
if _matches IS NOT NULL then
--EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename);
EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL now() + interval ''%I days'' ;', _usename, _thepassword, _password_lifetime);
-- INTO _retval;
RETURN 0;
EXECUTE format('ALTER ROLE ''%I'' WITH PASSWORD ''%L'' VALID UNTIL now() + interval ''%I days'' ;', _usename, _thepassword, _password_lifetime)
INTO _retval;
RETURN _retval;
else
raise exception 'Regular expresion for password check failed'
using errcode = '22023' -- 22023 = "invalid_parameter_value'
, detail = 'Check your generated password an try again'
, hint = 'Read the official documentation' ;
end if;
else
-- also catches NULL
else -- also catches NULL
-- raise custom error
raise exception 'You''re not allowed to run this function directly'
using errcode = '22023' -- 22023 = "invalid_parameter_value'
@ -87,9 +82,11 @@ begin
end
$BODY$;
ALTER FUNCTION dba.change_valid_until(text) OWNER TO dba;
ALTER FUNCTION dba.change_valid_until(text)
OWNER TO dba;
REVOKE EXECUTE ON FUNCTION dba.change_valid_until(text) From PUBLIC;
CREATE OR REPLACE FUNCTION dba.change_my_password(_password text)
RETURNS integer
SECURITY INVOKER
@ -134,6 +131,7 @@ begin
end
$BODY$;
ALTER FUNCTION dba.change_my_password(text) OWNER TO dba;
ALTER FUNCTION dba.change_my_password(text)
OWNER TO dba;
REVOKE EXECUTE ON FUNCTION dba.change_my_password(text) From PUBLIC;

68
passchanger_rds.sql
View File

@ -11,6 +11,7 @@ GRANT rds_superuser TO dba ;
-- grant select on pg_catalog.pg_authid to dba ;
grant pg_read_all_stats to dba ;
-- password history table
CREATE TABLE IF NOT EXISTS dba.pwdhistory
(
@ -49,25 +50,25 @@ CREATE OR REPLACE FUNCTION dba.change_valid_until(_usename text, _thepassword te
VOLATILE PARALLEL UNSAFE
AS $BODY$
declare
_invokingfunction text := '';
_matches text;
--_password_lifetime text := '120 days'; -- specify password lifetime
_retval INTEGER;
_expiration_date text;
_invokingfunction text := '';
_matches text;
_password_lifetime int := 120; -- specify password lifetime
_retval INTEGER;
_expiration_date text;
begin
select now() + interval '120 days' into _expiration_date ;
select query into _invokingfunction from pg_stat_activity where pid = pg_backend_pid() ;
-- first, checking the invoking function
-- raise notice 'Invoking function: %', _invokingfunction;
--_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i');
-- raise notice 'Matches: %', _matches;
if _matches IS NOT NULL then
-- then checking the regex for the password
_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\([[:space:]]{0,}''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''[[:space:]]{0,}\\)[[:space:]]{0,};' , 'i');
-- catch-all regexp, avoid using it
-- _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i');
-- _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i');
if _matches IS NOT NULL then
--EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL now() + interval %L days ;', _usename, _thepassword, _password_lifetime);
EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL %L ;', _usename, _thepassword, _expiration_date);
--EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename);
EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL ''%I'' ;', _usename, _thepassword, _expiration_date);
--EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL now() + interval ''120 days'' ;', _usename, _thepassword);
-- INTO _retval;
RETURN 0;
else
@ -76,8 +77,7 @@ begin
, detail = 'Check your generated password (' || _thepassword || ') an try again'
, hint = 'Read the official documentation' ;
end if;
else
-- also catches NULL
else -- also catches NULL
-- raise custom error
raise exception 'You''re not allowed to run this function directly'
using errcode = '22023' -- 22023 = "invalid_parameter_value'
@ -87,9 +87,11 @@ begin
end
$BODY$;
-- ALTER FUNCTION dba.change_valid_until(text, text) OWNER TO dba;
-- ALTER FUNCTION dba.change_valid_until(text, text) OWNER TO postgres;
ALTER FUNCTION dba.change_valid_until(text, text) OWNER TO dba;
REVOKE EXECUTE ON FUNCTION dba.change_valid_until(text, text) From PUBLIC;
CREATE OR REPLACE FUNCTION dba.change_my_password(_password text)
RETURNS integer
SECURITY INVOKER
@ -98,34 +100,38 @@ CREATE OR REPLACE FUNCTION dba.change_my_password(_password text)
VOLATILE PARALLEL UNSAFE
AS $BODY$
declare
_min_password_length int := 12; -- specify min length here
_usename text := '';
_useraddress text := '';
_userapp text := '';
_min_password_length int := 12; -- specify min length here
_usename text := '';
_useraddress text := '';
_userapp text := '';
begin
select user into _usename;
if user = 'postgres' then
raise exception 'This function should not be run by user postgres'
using errcode = '22024' -- 22023 = "invalid_parameter_value'
select user into _usename;
if user = 'postgres' then
raise exception 'This function should not be run by user postgres'
using errcode = '22024' -- 22023 = "invalid_parameter_value'
, detail = 'Use a named user only.' ;
end if;
end if;
if length(_password) < _min_password_length then
if length(_password) < _min_password_length then
-- also catches NULL
-- raise custom error
raise exception 'Password too short!'
using errcode = '22023' -- 22023 = "invalid_parameter_value'
, detail = 'Please check your password.'
, hint = 'Password must be at least ' || _min_password_length || ' characters.';
end if;
end if;
select client_addr into _useraddress from pg_stat_activity where pid = pg_backend_pid() ;
select application_name into _userapp from pg_stat_activity where pid = pg_backend_pid() ;
select client_addr into _useraddress from pg_stat_activity where pid = pg_backend_pid() ;
select application_name into _userapp from pg_stat_activity where pid = pg_backend_pid() ;
PERFORM dba.change_valid_until(_usename, _password) ;
insert into dba.pwdhistory
PERFORM dba.change_valid_until(_usename, _password) ;
insert into dba.pwdhistory
(usename, usename_addres, application_name, password, changed_on)
values (_usename, _useraddress, _userapp, md5(_password),now());
values (_usename, _useraddress, _userapp, md5(_password),now());
--
--
--
return 0;
end