public/postgresql_passchanger_function
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Compare commits

base: public:8f3c580bb4e83f36971076842b6228c81c610a86
Branches Tags
public:master
..
compare: public:624bad87b9717fe4fae3976cf6bf5ec9c7e3283e
Branches Tags
public:master

No commits in common. "8f3c580bb4e83f36971076842b6228c81c610a86" and "624bad87b9717fe4fae3976cf6bf5ec9c7e3283e" have entirely different histories.
8f3c580bb4 ... 624bad87b9

4 changed files with 20 additions and 204 deletions
Show Stats Expand all files Collapse all files

14
grants_to_grant.sql
View File

@ -5,20 +5,8 @@ grant usage on schema dba to dodger ;
-- grant execute on the function change_my_password -- grant execute on the function change_my_password
grant execute on function dba.change_my_password(text) to dodger; grant execute on function dba.change_my_password(text) to dodger;
-- grant execute on the function change_valid_until -- grant execute on the function change_valid_until
grant execute on function dba.change_valid_until(text, text) to dodger; grant execute on function dba.change_valid_until(text) to dodger;
-- only insert is needed to allow audit trace -- only insert is needed to allow audit trace
GRANT INSERT ON TABLE dba.pwdhistory TO dodger; GRANT INSERT ON TABLE dba.pwdhistory TO dodger;
-- SET SESSION AUTORIZATION dodger ;
'tV4{A#&x|P%hKM9*}4a0'
select dba.change_my_password( 'XFF{O>%|<e%_#F$pHqaB' ) ;
XFF{O>%|<e%_#F$pHqaB

12
grants_to_grant_rds.sql
View File

@ -1,12 +0,0 @@
-- grant usage for schema dba
grant usage on schema dba to dodger ;
-- grant execute on the function change_my_password
grant execute on function dba.change_my_password(text) to dodger;
-- grant execute on the function change_valid_until
grant execute on function dba.change_valid_until(text) to dodger;
-- only insert is needed to allow audit trace
GRANT INSERT ON TABLE dba.pwdhistory TO dodger;

48
passchanger.sql
View File

@ -49,29 +49,15 @@ AS $BODY$
declare declare
_invokingfunction text := ''; _invokingfunction text := '';
_matches text; _matches text;
_password_lifetime int := 120; -- specify password lifetime
_retval INTEGER;
begin begin
select query into _invokingfunction from pg_stat_activity where pid = pg_backend_pid() ; select query into _invokingfunction from pg_stat_activity where pid = pg_backend_pid() ;
-- raise notice 'Invoking function: %', _invokingfunction; -- raise notice 'Invoking function: %', _invokingfunction;
--_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i'); --_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=){1,100}''\\)[[:space:]]{0,};' , 'i');
_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i'); _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
-- raise notice 'Matches: %', _matches; -- raise notice 'Matches: %', _matches;
if _matches IS NOT NULL then if _matches IS NOT NULL then
EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename); EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename);
return 0; return 0;
_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
if _matches IS NOT NULL then
--EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename);
EXECUTE format('ALTER ROLE ''%I'' WITH PASSWORD ''%L'' VALID UNTIL now() + interval ''%I days'' ;', _usename, _thepassword, _password_lifetime)
INTO _retval;
RETURN _retval;
else
raise exception 'Regular expresion for password check failed'
using errcode = '22023' -- 22023 = "invalid_parameter_value'
, detail = 'Check your generated password an try again'
, hint = 'Read the official documentation' ;
end if;
else -- also catches NULL else -- also catches NULL
-- raise custom error -- raise custom error
raise exception 'You''re not allowed to run this function directly' raise exception 'You''re not allowed to run this function directly'
@ -95,37 +81,33 @@ CREATE OR REPLACE FUNCTION dba.change_my_password(_password text)
VOLATILE PARALLEL UNSAFE VOLATILE PARALLEL UNSAFE
AS $BODY$ AS $BODY$
declare declare
_min_password_length int := 12; -- specify min length here _min_password_length int := 8; -- specify min length here
_usename text := ''; _usename text := '';
_useraddress text := ''; _useraddress text := '';
_userapp text := ''; _userapp text := '';
begin begin
select user into _usename; select user into _usename;
if user = 'postgres' then select client_addr into _useraddress from pg_stat_activity where pid = pg_backend_pid() ;
raise exception 'This function should not be run by user postgres' select application_name into _userapp from pg_stat_activity where pid = pg_backend_pid() ;
using errcode = '22024' -- 22023 = "invalid_parameter_value' if length(_password) >= _min_password_length then
, detail = 'Use a named user only.' ; EXECUTE format('ALTER USER %I WITH PASSWORD %L', _usename, _password);
end if; else -- also catches NULL
if length(_password) < _min_password_length then
-- also catches NULL
-- raise custom error -- raise custom error
raise exception 'Password too short!' raise exception 'Password too short!'
using errcode = '22023' -- 22023 = "invalid_parameter_value' using errcode = '22023' -- 22023 = "invalid_parameter_value'
, detail = 'Please check your password.' , detail = 'Please check your password.'
, hint = 'Password must be at least ' || _min_password_length || ' characters.'; , hint = 'Password must be at least ' || _min_password_length || ' characters.';
end if; end if;
if user = 'postgres' then
select client_addr into _useraddress from pg_stat_activity where pid = pg_backend_pid() ; raise exception 'This function should not be run by user postgres'
select application_name into _userapp from pg_stat_activity where pid = pg_backend_pid() ; using errcode = '22024' -- 22023 = "invalid_parameter_value'
, detail = 'Use a named user only.' ;
-- this will be executed by the username invoking this function else
EXECUTE format('ALTER USER %I WITH PASSWORD %L', _usename, _password);
PERFORM dba.change_valid_until(_usename) ;
insert into dba.pwdhistory insert into dba.pwdhistory
(usename, usename_addres, application_name, password, changed_on) (usename, usename_addres, application_name, password, changed_on)
values (_usename, _useraddress, _userapp, md5(_password),now()); values (_usename, _useraddress, _userapp, md5(_password),now());
PERFORM dba.change_valid_until(_usename) ;
end if;
return 0; return 0;
end end

142
passchanger_rds.sql
View File

@ -1,142 +0,0 @@
-- Schema creation
create schema dba ;
-- role creation
create role dba with NOLOGIN NOINHERIT ;
-- grants for dba
GRANT rds_superuser TO dba ;
-- grant select on pg_catalog.pg_authid to dba ;
grant pg_read_all_stats to dba ;
-- password history table
CREATE TABLE IF NOT EXISTS dba.pwdhistory
(
usename character varying COLLATE pg_catalog."default",
usename_addres character varying COLLATE pg_catalog."default",
application_name character varying COLLATE pg_catalog."default",
password character varying COLLATE pg_catalog."default",
changed_on timestamp without time zone
)
TABLESPACE pg_default;
-- alter if you come from a previous version of the table:
-- alter table dba.pwdhistory add column usename_addres character varying ;
-- alter table dba.pwdhistory add column application_name character varying ;
ALTER TABLE IF EXISTS dba.pwdhistory
OWNER to dba;
-- ######################################
-- ######################################
-- real functions
-- ######################################
-- ######################################
drop function dba.change_valid_until ;
CREATE OR REPLACE FUNCTION dba.change_valid_until(_usename text, _thepassword text)
RETURNS integer
SECURITY DEFINER
LANGUAGE 'plpgsql'
COST 100
VOLATILE PARALLEL UNSAFE
AS $BODY$
declare
_invokingfunction text := '';
_matches text;
_password_lifetime int := 120; -- specify password lifetime
_retval INTEGER;
_expiration_date text;
begin
select now() + interval '120 days' into _expiration_date ;
select query into _invokingfunction from pg_stat_activity where pid = pg_backend_pid() ;
-- raise notice 'Invoking function: %', _invokingfunction;
--_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i');
-- raise notice 'Matches: %', _matches;
if _matches IS NOT NULL then
-- _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i');
if _matches IS NOT NULL then
--EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename);
EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL ''%I'' ;', _usename, _thepassword, _expiration_date);
--EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL now() + interval ''120 days'' ;', _usename, _thepassword);
-- INTO _retval;
RETURN 0;
else
raise exception 'Regular expresion for password check failed'
using errcode = '22023' -- 22023 = "invalid_parameter_value'
, detail = 'Check your generated password (' || _thepassword || ') an try again'
, hint = 'Read the official documentation' ;
end if;
else -- also catches NULL
-- raise custom error
raise exception 'You''re not allowed to run this function directly'
using errcode = '22023' -- 22023 = "invalid_parameter_value'
, detail = 'Please call dba.change_my_password function.'
, hint = 'Invoked function: ' || _invokingfunction ;
end if;
end
$BODY$;
-- ALTER FUNCTION dba.change_valid_until(text, text) OWNER TO postgres;
ALTER FUNCTION dba.change_valid_until(text, text) OWNER TO dba;
REVOKE EXECUTE ON FUNCTION dba.change_valid_until(text, text) From PUBLIC;
CREATE OR REPLACE FUNCTION dba.change_my_password(_password text)
RETURNS integer
SECURITY INVOKER
LANGUAGE 'plpgsql'
COST 100
VOLATILE PARALLEL UNSAFE
AS $BODY$
declare
_min_password_length int := 12; -- specify min length here
_usename text := '';
_useraddress text := '';
_userapp text := '';
begin
select user into _usename;
if user = 'postgres' then
raise exception 'This function should not be run by user postgres'
using errcode = '22024' -- 22023 = "invalid_parameter_value'
, detail = 'Use a named user only.' ;
end if;
if length(_password) < _min_password_length then
-- also catches NULL
-- raise custom error
raise exception 'Password too short!'
using errcode = '22023' -- 22023 = "invalid_parameter_value'
, detail = 'Please check your password.'
, hint = 'Password must be at least ' || _min_password_length || ' characters.';
end if;
select client_addr into _useraddress from pg_stat_activity where pid = pg_backend_pid() ;
select application_name into _userapp from pg_stat_activity where pid = pg_backend_pid() ;
PERFORM dba.change_valid_until(_usename, _password) ;
insert into dba.pwdhistory
(usename, usename_addres, application_name, password, changed_on)
values (_usename, _useraddress, _userapp, md5(_password),now());
--
--
--
return 0;
end
$BODY$;
ALTER FUNCTION dba.change_my_password(text) OWNER TO dba;
REVOKE EXECUTE ON FUNCTION dba.change_my_password(text) From PUBLIC;