Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

maint: enable SCRAM support #193

Merged
merged 3 commits into from
May 23, 2024
Merged

maint: enable SCRAM support #193

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
17cb11a
maint: enable SCRAM support
mble-sfdc May 21, 2024
e7c5b91
update tests
mble-sfdc May 21, 2024
49fb549
add updates from feedback
mble-sfdc May 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions Changelog.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
## Unreleased
* Support SCRAM authentication, use plain passwords in auth_file
edmorley marked this conversation as resolved.
Show resolved Hide resolved

## v0.14.0 (May 20, 2024)
* Converted our remaining CircleCI tests to Github Actions
Expand Down
8 changes: 3 additions & 5 deletions bin/gen-pgbouncer-conf.sh
View file
Open in desktop
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Guessing this will never be used on a multiuser system, but if it's possible, setting a umask up at the top to ensure the users.txt file is ONLY readable by the intended user/group would be a good practice. But this is likely going in a single-user container so prob not necessary.

Original file line number Diff line number Diff line change
Expand Up @@ -19,9 +19,9 @@ cat >> "$CONFIG_DIR/pgbouncer.ini" << EOFEOF
[pgbouncer]
listen_addr = 127.0.0.1
listen_port = 6000
auth_type = md5
auth_type = scram-sha-256
auth_file = $CONFIG_DIR/users.txt
server_tls_sslmode = prefer
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we expect this change to break anything? I suspect not now that we support TLS fleet-wide.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not expect this to break anything - frankly if it does, consumers of the buildpack have bigger problems to worry about. We've been enforcing TLS for some time now.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We've seen a few GitHub Issues in the past where customers are using the buildpack to connect to RDS/Crunchy/etc. I hope that this change doesn't impact that as well but I would assume they are also supporting TLS and agree customers have bigger problems if they are not for some reason.

server_tls_sslmode = require
server_tls_protocols = secure
server_tls_ciphers = HIGH:!ADH:!AECDH:!LOW:!EXP:!MD5:!3DES:!SRP:!PSK:@STRENGTH

Expand Down Expand Up @@ -72,8 +72,6 @@ do
fi
done

DB_MD5_PASS="md5"$(echo -n "${DB_PASS}""${DB_USER}" | md5sum | awk '{print $1}')

CLIENT_DB_NAME="db${n}"

echo "Setting ${POSTGRES_URL}_PGBOUNCER config var"
Expand All @@ -86,7 +84,7 @@ do
fi

cat >> "$CONFIG_DIR/users.txt" << EOFEOF
"$DB_USER" "$DB_MD5_PASS"
"$DB_USER" "$DB_PASS"
EOFEOF

cat >> "$CONFIG_DIR/pgbouncer.ini" << EOFEOF
Expand Down
3 changes: 2 additions & 1 deletion test/gen-pgbouncer-conf.bats
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,8 @@ teardown_file() {
assert_success
cat "$PGBOUNCER_CONFIG_DIR/pgbouncer.ini"
assert_line 'Setting DATABASE_URL_PGBOUNCER config var'
assert grep "server_tls_sslmode = prefer" "$PGBOUNCER_CONFIG_DIR/pgbouncer.ini"
assert grep "auth_type = scram-sha-256" "$PGBOUNCER_CONFIG_DIR/pgbouncer.ini"
assert grep "server_tls_sslmode = require" "$PGBOUNCER_CONFIG_DIR/pgbouncer.ini"
assert grep "db1= host=host dbname=name?query port=5432" "$PGBOUNCER_CONFIG_DIR/pgbouncer.ini"
assert grep "db2= host=host2 dbname=dbname port=7777" "$PGBOUNCER_CONFIG_DIR/pgbouncer.ini"
assert grep "user" "$PGBOUNCER_CONFIG_DIR/users.txt"
edmorley marked this conversation as resolved.
Show resolved Hide resolved
Expand Down