This version celebrates the 15th anniversary of Pgpool-II, and introduces rich new features. I will explain them one by one in a series of blogs.
Support for SCRAM authentication
SCRAM authentication is a modern, secure authentication method supported by PostgreSQL 10 or later. Pgpool-II 4.0 supports the method by providing multiple new functionalities.- pool_hba.conf now has "scram-sha-256" authentication method.
- If this method is specified, users connecting to Pgpool-II are required to response in proper way of SCRAM authentication.
- Passwords stored in pool_passwd can be used to verify user's password before a session starts.
- Passwords can be store in pool_passwd in multiple ways: clear text or AES256 encrypted (md5 hashed passwords can also be stored in pool_passwd but in this case SCRAM cannot use the password).
- AES256 encryption is preferred and the key to decrypt it is stored in .pgpoolkey under the user's home directory who started Pgpool-II, or a file specified by PGPOOLKEYFILE environment variable.
- For AES256 encryption, new tool pg_enc can be used.
Good thing with Pgpool-II 4.0 is, it allows users to choose different authentication method in users vs. Pgpool-II and Pgpool-II vs. PostgreSQL. For example, using SCRAM between users and Pgpool-II, while using md5 authentication method between Pgpool-II and PostgreSQL.
SCRAM authentication can also be used for health check and replication delay check. Before 4.0, user name and password for them are stored in clear text format in pgpool.conf. This is not the most secure way. Pgpool-II 4.0 allows to store AES 256 encrypted passwords in pgpool.conf. .pgpookey is also used for decrypting these passwords.
Next time I will explain about other features of authentication method in Pgpool-II 4.0.
