Update PG installation documentation to use SCRAM

Description

Since PostgreSQL is able to use SCRAM as an authentication method we should get rid of suggesting MD5 in our installation guide.

If you are running PG X or more, here are instructions to configure this ....

Need to have engineering verify that we support it.

Documentation

  1. deployment/core/getting-started.adoc references MD5 hashed passwords. Update this section with directions and appropriate caveats for supported versions

  2. Check other references to MD5 in the docs and add SCRAM option if appropriate.

 

Acceptance / Success Criteria

None

Lucidchart Diagrams

Activity

Show:

Bonnie Robinson August 8, 2022 at 6:25 PM

Closed previous PR and created new one to rebase branch on Foundation-2022: https://github.com/OpenNMS/opennms/pull/5163

Marcel Fuhrmann August 4, 2022 at 6:38 PM

Marcel Fuhrmann June 20, 2022 at 4:55 PM

I've installed now an Ubuntu 22.04 server and PostgreSQL 14.

As you can see the default is here SCRAM:

```

postgres@ubuntuserver2204:/root$ cat /etc/postgresql/14/main/pg_hba.conf  | grep -v ^#

local   all             postgres                                peer

local   all             all                                     peer
host    all             all             127.0.0.1/32            scram-sha-256
host    all             all             ::1/128                 scram-sha-256
local   replication     all                                     peer
host    replication     all             127.0.0.1/32            scram-sha-256
host    replication     all             ::1/128                 scram-sha-256
```
```
postgres@ubuntuserver2204:/root$ cat /etc/postgresql/14/main/postgresql.conf | grep scram
#password_encryption = scram-sha-256    # scram-sha-256 or md5
```

By following the normal installation process we have everything working fine. So I guess we could just add a hint to change to consider using SCRAM when running PG < 14.

 

Marcel Fuhrmann June 3, 2022 at 8:55 AM

With PG 14 the default changed to SCRAM as you can see here:
https://www.postgresql.org/docs/14/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION (The default is scram-sha-256.)

Here for PG 13:
https://www.postgresql.org/docs/13/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION (The default value is md5)

As long as we don't require to use PG 14 (and our call yesterday identified that CentOS 7 is still using PG 10) for ONMS, we should probably just add a hint in our PG installation docs that MD5 should not be used anymore.
But of course we should test first if ONMS is working using SCRAM. I will give that a try.

FYI

Marcel Fuhrmann December 16, 2020 at 10:29 PM

The JDBC upgrade is not required to use SCRAM, but an additional step to bring this PG Jdbc topics up to date.

Fixed

Details

Assignee

Reporter

Internal Priority

Low Low

Doc Backlog Status

Doc Backlog Grooming Date

Sprint

Affects versions

Priority

PagerDuty

Created December 16, 2020 at 10:26 PM
Updated August 8, 2022 at 8:19 PM
Resolved August 8, 2022 at 8:19 PM