Update PG installation documentation to use SCRAM
Description
Acceptance / Success Criteria
depends on
related to
Lucidchart Diagrams
Activity
Bonnie Robinson August 8, 2022 at 6:25 PM
Closed previous PR and created new one to rebase branch on Foundation-2022: https://github.com/OpenNMS/opennms/pull/5163
Marcel Fuhrmann June 20, 2022 at 4:55 PM
I've installed now an Ubuntu 22.04 server and PostgreSQL 14.
As you can see the default is here SCRAM:
```
postgres@ubuntuserver2204:/root$ cat /etc/postgresql/14/main/pg_hba.conf | grep -v ^#
local all postgres peer
local all all peer
host all all 127.0.0.1/32 scram-sha-256
host all all ::1/128 scram-sha-256
local replication all peer
host replication all 127.0.0.1/32 scram-sha-256
host replication all ::1/128 scram-sha-256
```
```
postgres@ubuntuserver2204:/root$ cat /etc/postgresql/14/main/postgresql.conf | grep scram
#password_encryption = scram-sha-256 # scram-sha-256 or md5
```
By following the normal installation process we have everything working fine. So I guess we could just add a hint to change to consider using SCRAM when running PG < 14.
Marcel Fuhrmann June 3, 2022 at 8:55 AM
With PG 14 the default changed to SCRAM as you can see here:
https://www.postgresql.org/docs/14/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION (The default is scram-sha-256.)
Here for PG 13:
https://www.postgresql.org/docs/13/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION (The default value is md5)
As long as we don't require to use PG 14 (and our call yesterday identified that CentOS 7 is still using PG 10) for ONMS, we should probably just add a hint in our PG installation docs that MD5 should not be used anymore.
But of course we should test first if ONMS is working using SCRAM. I will give that a try.
FYI
Marcel Fuhrmann December 16, 2020 at 10:29 PM
The JDBC upgrade is not required to use SCRAM, but an additional step to bring this PG Jdbc topics up to date.
Details
Assignee
Marcel FuhrmannMarcel FuhrmannReporter
Marcel FuhrmannMarcel FuhrmannInternal Priority
Low LowDoc Backlog Status
DBDoc Backlog Grooming Date
Jun 08, 2021Components
Sprint
NoneFix versions
Affects versions
Priority
Minor
Details
Details
Assignee
Reporter
Internal Priority
Doc Backlog Status
Doc Backlog Grooming Date
Components
Sprint
Fix versions
Affects versions
Priority
PagerDuty
PagerDuty Incident
PagerDuty
PagerDuty Incident
PagerDuty

Since PostgreSQL is able to use SCRAM as an authentication method we should get rid of suggesting MD5 in our installation guide.
If you are running PG X or more, here are instructions to configure this ....
Need to have engineering verify that we support it.
Documentation
deployment/core/getting-started.adoc references MD5 hashed passwords. Update this section with directions and appropriate caveats for supported versions
Check other references to MD5 in the docs and add SCRAM option if appropriate.