Merge pull request #762 from madtibo/pg_pwd_security

[enh] PostgreSQL password security

data/helpers.d/postgresql

@@ -283,11 +283,11 @@ ynh_psql_test_if_first_run() {
 
 		sudo --login --user=postgres psql -c"ALTER user postgres WITH PASSWORD '$psql_root_password'" postgres
 
-		# force all user to connect to local database using passwords
+		# force all user to connect to local databases using hashed passwords
 		# https://www.postgresql.org/docs/current/static/auth-pg-hba-conf.html#EXAMPLE-PG-HBA.CONF
 		# Note: we can't use peer since YunoHost create users with nologin
 		#  See: https://github.com/YunoHost/yunohost/blob/unstable/data/helpers.d/user
-		ynh_replace_string --match_string="local\(\s*\)all\(\s*\)all\(\s*\)peer" --replace_string="local\1all\2all\3password" --target_file="$pg_hba"
+		ynh_replace_string --match_string="local\(\s*\)all\(\s*\)all\(\s*\)peer" --replace_string="local\1all\2all\3md5" --target_file="$pg_hba"
 
 		# Advertise service in admin panel
 		yunohost service add postgresql --log "$logfile"

locales/en.json

@@ -331,6 +331,7 @@
     "migration_description_0009_decouple_regenconf_from_services": "Decouple the regen-conf mechanism from services",
     "migration_description_0010_migrate_to_apps_json": "Remove deprecated appslists and use the new unified 'apps.json' list instead",
     "migration_description_0011_setup_group_permission": "Setup user group and setup permission for apps and services",
+    "migration_description_0012_postgresql_password_to_md5_authentication": "Force postgresql authentication to use md5 for local connections",
     "migration_0003_backward_impossible": "The stretch migration cannot be reverted.",
     "migration_0003_start": "Starting migration to Stretch. The logs will be available in {logfile}.",
     "migration_0003_patching_sources_list": "Patching the sources.lists…",

src/yunohost/data_migrations/0012_postgresql_password_to_md5_authentication.py

@@ -0,0 +1,21 @@
+import glob
+import re
+from yunohost.tools import Migration
+from moulinette.utils.filesystem import read_file, write_to_file
+
+
+class MyMigration(Migration):
+
+    "Force authentication in md5 for local connexions"
+
+    all_hba_files = glob.glob("/etc/postgresql/*/*/pg_hba.conf")
+
+    def forward(self):
+        for filename in self.all_hba_files:
+            pg_hba_in = read_file(filename)
+            write_to_file(filename, re.sub(r"local(\s*)all(\s*)all(\s*)password", "local\\1all\\2all\\3md5", pg_hba_in))
+
+    def backward(self):
+        for filename in self.all_hba_files:
+            pg_hba_in = read_file(filename)
+            write_to_file(filename, re.sub(r"local(\s*)all(\s*)all(\s*)md5", "local\\1all\\2all\\3password", pg_hba_in))