audit-labs/audit-tools

A collection of scripts, queries, and other goodies you can use in an audit. audit automation compliance evidence scripts

Commit d4a2721a85

d4a2721a85223da97d042729f2e7916de0b73e6d

parent: 818eb1c290

Unsigned

cmc <hello@cleberg.net> · 2025-04-25 22:37 UTC
committer: <noreply@github.com>

MySQL & Postgres Enhancements (#5)

* remove mysql login script and add password script

* move excess mysql password query to new script

* add db admin folders

* add postgres

* add mongo admins script

* Commit from GitHub Actions (Ruff)

* update tests for mysql and postgres

* update tests for mysql and postgres

---------

Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>

Layout: unified · split

databases/administrators/mssql_admins.sql → databases/administrators/microsoft-sql/mssql_admins.sql renamed
databases/administrators/mongo/README.org added +104
@@ -0,0 +1,104 @@
1#+title: MongoDB Scripts
2
3* =admins.py=
4
5Dependency:
6
7#+begin_src shell
8pip install pymongo
9#+end_src
10
11#+begin_src python
12python ./admins.py
13#+end_src
14
15Example output:
16
17#+begin_src json
18[
19 {
20 "_id": "admin.admin",
21 "user": "admin",
22 "db": "admin",
23 "roles": [
24 {
25 "role": "userAdminAnyDatabase",
26 "db": "admin"
27 },
28 {
29 "role": "readWriteAnyDatabase",
30 "db": "admin"
31 },
32 {
33 "role": "dbAdminAnyDatabase",
34 "db": "admin"
35 },
36 {
37 "role": "clusterAdmin",
38 "db": "admin"
39 }
40 ],
41 "credentials": {
42 "SCRAM-SHA-1": {
43 "iterationCount": 10000,
44 "salt": "abc123",
45 "storedKey": "storedKeyHash",
46 "serverKey": "serverKeyHash"
47 },
48 "SCRAM-SHA-256": {
49 "iterationCount": 15000,
50 "salt": "def456",
51 "storedKey": "storedKeyHash256",
52 "serverKey": "serverKeyHash256"
53 }
54 }
55 },
56 {
57 "_id": "test.user1",
58 "user": "user1",
59 "db": "test",
60 "roles": [
61 {
62 "role": "readWrite",
63 "db": "test"
64 }
65 ],
66 "credentials": {
67 "SCRAM-SHA-1": {
68 "iterationCount": 10000,
69 "salt": "ghi789",
70 "storedKey": "storedKeyHashUser1",
71 "serverKey": "serverKeyHashUser1"
72 }
73 }
74 },
75 {
76 "_id": "test.ldapUser",
77 "user": "ldapUser",
78 "db": "test",
79 "roles": [
80 {
81 "role": "read",
82 "db": "test"
83 }
84 ],
85 "userSource": "ldap"
86 },
87 {
88 "_id": "admin.x509User",
89 "user": "x509User",
90 "db": "$external",
91 "roles": [
92 {
93 "role": "readWrite",
94 "db": "admin"
95 }
96 ],
97 "credentials": {
98 "MONGODB-X509": {
99 "subject": "CN=x509User,OU=OrgUnit,O=Org,L=City,ST=State,C=Country"
100 }
101 }
102 }
103]
104#+end_src
databases/administrators/mongo/admins.py added +16
@@ -0,0 +1,16 @@
1from pymongo import MongoClient
2
3# Connect to the MongoDB server
4client = MongoClient("mongodb://localhost:27017/")
5
6# Select the 'admin' database
7db = client.admin
8
9# Query the 'system.users' collection
10users = db.system.users.find(
11 {}, {"user": 1, "db": 1, "roles": 1, "credentials": 1, "userSource": 1}
12)
13
14# Print the results in a pretty format
15for user in users:
16 print(user)
databases/administrators/mysql/README.org added +108
@@ -0,0 +1,108 @@
1#+title: MySQL Admins
2
3* =mysql_admins.sql=
4
5#+begin_src sql
6SELECT * FROM information_schema.user_privileges;
7#+end_src
8
9#+begin_src
10MySQL [(none)]> SELECT * FROM information_schema.user_privileges;
11+--------------------------------+---------------+---------------------------------+--------------+
12| GRANTEE | TABLE_CATALOG | PRIVILEGE_TYPE | IS_GRANTABLE |
13+--------------------------------+---------------+---------------------------------+--------------+
14| 'mysql.infoschema'@'localhost' | def | SELECT | NO |
15| 'mysql.infoschema'@'localhost' | def | AUDIT_ABORT_EXEMPT | NO |
16| 'mysql.infoschema'@'localhost' | def | FIREWALL_EXEMPT | NO |
17| 'mysql.infoschema'@'localhost' | def | SYSTEM_USER | NO |
18| 'mysql.session'@'localhost' | def | SHUTDOWN | NO |
19| 'mysql.session'@'localhost' | def | SUPER | NO |
20| 'mysql.session'@'localhost' | def | AUDIT_ABORT_EXEMPT | NO |
21| 'mysql.session'@'localhost' | def | AUTHENTICATION_POLICY_ADMIN | NO |
22| 'mysql.session'@'localhost' | def | BACKUP_ADMIN | NO |
23| 'mysql.session'@'localhost' | def | CLONE_ADMIN | NO |
24| 'mysql.session'@'localhost' | def | CONNECTION_ADMIN | NO |
25| 'mysql.session'@'localhost' | def | FIREWALL_EXEMPT | NO |
26| 'mysql.session'@'localhost' | def | PERSIST_RO_VARIABLES_ADMIN | NO |
27| 'mysql.session'@'localhost' | def | SESSION_VARIABLES_ADMIN | NO |
28| 'mysql.session'@'localhost' | def | SYSTEM_USER | NO |
29| 'mysql.session'@'localhost' | def | SYSTEM_VARIABLES_ADMIN | NO |
30| 'mysql.sys'@'localhost' | def | USAGE | NO |
31| 'mysql.sys'@'localhost' | def | AUDIT_ABORT_EXEMPT | NO |
32| 'mysql.sys'@'localhost' | def | FIREWALL_EXEMPT | NO |
33| 'mysql.sys'@'localhost' | def | SYSTEM_USER | NO |
34| 'root'@'localhost' | def | SELECT | YES |
35| 'root'@'localhost' | def | INSERT | YES |
36| 'root'@'localhost' | def | UPDATE | YES |
37| 'root'@'localhost' | def | DELETE | YES |
38| 'root'@'localhost' | def | CREATE | YES |
39| 'root'@'localhost' | def | DROP | YES |
40| 'root'@'localhost' | def | RELOAD | YES |
41| 'root'@'localhost' | def | SHUTDOWN | YES |
42| 'root'@'localhost' | def | PROCESS | YES |
43| 'root'@'localhost' | def | FILE | YES |
44| 'root'@'localhost' | def | REFERENCES | YES |
45| 'root'@'localhost' | def | INDEX | YES |
46| 'root'@'localhost' | def | ALTER | YES |
47| 'root'@'localhost' | def | SHOW DATABASES | YES |
48| 'root'@'localhost' | def | SUPER | YES |
49| 'root'@'localhost' | def | CREATE TEMPORARY TABLES | YES |
50| 'root'@'localhost' | def | LOCK TABLES | YES |
51| 'root'@'localhost' | def | EXECUTE | YES |
52| 'root'@'localhost' | def | REPLICATION SLAVE | YES |
53| 'root'@'localhost' | def | REPLICATION CLIENT | YES |
54| 'root'@'localhost' | def | CREATE VIEW | YES |
55| 'root'@'localhost' | def | SHOW VIEW | YES |
56| 'root'@'localhost' | def | CREATE ROUTINE | YES |
57| 'root'@'localhost' | def | ALTER ROUTINE | YES |
58| 'root'@'localhost' | def | CREATE USER | YES |
59| 'root'@'localhost' | def | EVENT | YES |
60| 'root'@'localhost' | def | TRIGGER | YES |
61| 'root'@'localhost' | def | CREATE TABLESPACE | YES |
62| 'root'@'localhost' | def | CREATE ROLE | YES |
63| 'root'@'localhost' | def | DROP ROLE | YES |
64| 'root'@'localhost' | def | ALLOW_NONEXISTENT_DEFINER | YES |
65| 'root'@'localhost' | def | APPLICATION_PASSWORD_ADMIN | YES |
66| 'root'@'localhost' | def | AUDIT_ABORT_EXEMPT | YES |
67| 'root'@'localhost' | def | AUDIT_ADMIN | YES |
68| 'root'@'localhost' | def | AUTHENTICATION_POLICY_ADMIN | YES |
69| 'root'@'localhost' | def | BACKUP_ADMIN | YES |
70| 'root'@'localhost' | def | BINLOG_ADMIN | YES |
71| 'root'@'localhost' | def | BINLOG_ENCRYPTION_ADMIN | YES |
72| 'root'@'localhost' | def | CLONE_ADMIN | YES |
73| 'root'@'localhost' | def | CONNECTION_ADMIN | YES |
74| 'root'@'localhost' | def | CREATE_SPATIAL_REFERENCE_SYSTEM | YES |
75| 'root'@'localhost' | def | ENCRYPTION_KEY_ADMIN | YES |
76| 'root'@'localhost' | def | FIREWALL_EXEMPT | YES |
77| 'root'@'localhost' | def | FLUSH_OPTIMIZER_COSTS | YES |
78| 'root'@'localhost' | def | FLUSH_PRIVILEGES | YES |
79| 'root'@'localhost' | def | FLUSH_STATUS | YES |
80| 'root'@'localhost' | def | FLUSH_TABLES | YES |
81| 'root'@'localhost' | def | FLUSH_USER_RESOURCES | YES |
82| 'root'@'localhost' | def | GROUP_REPLICATION_ADMIN | YES |
83| 'root'@'localhost' | def | GROUP_REPLICATION_STREAM | YES |
84| 'root'@'localhost' | def | INNODB_REDO_LOG_ARCHIVE | YES |
85| 'root'@'localhost' | def | INNODB_REDO_LOG_ENABLE | YES |
86| 'root'@'localhost' | def | OPTIMIZE_LOCAL_TABLE | YES |
87| 'root'@'localhost' | def | PASSWORDLESS_USER_ADMIN | YES |
88| 'root'@'localhost' | def | PERSIST_RO_VARIABLES_ADMIN | YES |
89| 'root'@'localhost' | def | REPLICATION_APPLIER | YES |
90| 'root'@'localhost' | def | REPLICATION_SLAVE_ADMIN | YES |
91| 'root'@'localhost' | def | RESOURCE_GROUP_ADMIN | YES |
92| 'root'@'localhost' | def | RESOURCE_GROUP_USER | YES |
93| 'root'@'localhost' | def | ROLE_ADMIN | YES |
94| 'root'@'localhost' | def | SENSITIVE_VARIABLES_OBSERVER | YES |
95| 'root'@'localhost' | def | SERVICE_CONNECTION_ADMIN | YES |
96| 'root'@'localhost' | def | SESSION_VARIABLES_ADMIN | YES |
97| 'root'@'localhost' | def | SET_ANY_DEFINER | YES |
98| 'root'@'localhost' | def | SHOW_ROUTINE | YES |
99| 'root'@'localhost' | def | SYSTEM_USER | YES |
100| 'root'@'localhost' | def | SYSTEM_VARIABLES_ADMIN | YES |
101| 'root'@'localhost' | def | TABLE_ENCRYPTION_ADMIN | YES |
102| 'root'@'localhost' | def | TELEMETRY_LOG_ADMIN | YES |
103| 'root'@'localhost' | def | TRANSACTION_GTID_TAG | YES |
104| 'root'@'localhost' | def | XA_RECOVER_ADMIN | YES |
105| 'cmc'@'%' | def | USAGE | NO |
106+--------------------------------+---------------+---------------------------------+--------------+
10792 rows in set (0.001 sec)
108#+end_src
databases/administrators/mysql/mysql_admins.sql added +1
@@ -0,0 +1 @@
1SELECT * FROM information_schema.user_privileges;
Password Configuration → databases/administrators/mysql/mysql_admins_alt.sql renamed −3
@@ -12,7 +12,3 @@ WHERE db = @db_name;
12-- Column Permissions 12-- Column Permissions
13SELECT ... FROM mysql.columns_priv 13SELECT ... FROM mysql.columns_priv
14WHERE db = @db_name; 14WHERE db = @db_name;
15
16SHOW GLOBAL VARIABLES LIKE 'validate_password%';
17SHOW VARIABLES LIKE 'validate_password%';
databases/administrators/mysql_admins.sh deleted −1
@@ -1 +0,0 @@
1mysql -u root -p
databases/administrators/mysql_admins.sql deleted −1
@@ -1 +0,0 @@
1SELECT ** FROM information_schema.user_privileges;
databases/administrators/oracle_admins.sql → databases/administrators/oracle/oracle_admins.sql renamed
databases/administrators/oracle_admins_alt.sql → databases/administrators/oracle/oracle_admins_alt.sql renamed
databases/administrators/postgres/README.org added +45
@@ -0,0 +1,45 @@
1#+title: Postgres Admins
2
3* =admins.sql=
4
5#+begin_src sql
6SELECT
7 r.rolname AS role_name,
8 r.rolsuper AS is_superuser,
9 r.rolinherit AS inherits_privileges,
10 r.rolcreaterole AS can_create_roles,
11 r.rolcreatedb AS can_create_db,
12 r.rolcanlogin AS can_login,
13 r.rolreplication AS can_replication,
14 r.rolconnlimit AS connection_limit,
15 r.rolvaliduntil AS valid_until,
16 ARRAY(
17 SELECT b.rolname
18 FROM pg_auth_members m
19 JOIN pg_roles b ON (m.roleid = b.oid)
20 WHERE m.member = r.oid
21 ) AS member_of
22FROM pg_roles r;
23#+end_src
24
25#+begin_src
26| role_name | is_superuser | inherits_privileges | can_create_roles | can_create_db | can_login | can_replication | connection_limit | valid_until | member_of |
27|-----------------------------+--------------+---------------------+------------------+---------------+-----------+-----------------+------------------+------------------------+--------------------------------------------------------------|
28| cmc | true | true | true | true | true | true | -1 | | {} |
29| pg_database_owner | false | true | false | false | false | false | -1 | | {} |
30| pg_read_all_data | false | true | false | false | false | false | -1 | | {} |
31| pg_write_all_data | false | true | false | false | false | false | -1 | | {} |
32| pg_monitor | false | true | false | false | false | false | -1 | | {pg_read_all_settings,pg_read_all_stats,pg_stat_scan_tables} |
33| pg_read_all_settings | false | true | false | false | false | false | -1 | | {} |
34| pg_read_all_stats | false | true | false | false | false | false | -1 | | {} |
35| pg_stat_scan_tables | false | true | false | false | false | false | -1 | | {} |
36| pg_read_server_files | false | true | false | false | false | false | -1 | | {} |
37| pg_write_server_files | false | true | false | false | false | false | -1 | | {} |
38| pg_execute_server_program | false | true | false | false | false | false | -1 | | {} |
39| pg_signal_backend | false | true | false | false | false | false | -1 | | {} |
40| pg_checkpoint | false | true | false | false | false | false | -1 | | {} |
41| pg_maintain | false | true | false | false | false | false | -1 | | {} |
42| pg_use_reserved_connections | false | true | false | false | false | false | -1 | | {} |
43| pg_create_subscription | false | true | false | false | false | false | -1 | | {} |
44| testuser | false | true | false | false | true | false | -1 | 2025-12-31 00:00:00-06 | {} |
45#+end_src
databases/administrators/postgres/admins.sql added +22
@@ -0,0 +1,22 @@
1-- References:
2-- : https://www.postgresql.org/docs/current/user-manag.html
3-- : https://www.postgresql.org/docs/current/view-pg-roles.html
4-- : https://www.postgresql.org/docs/current/catalog-pg-auth-members.html
5
6SELECT
7 r.rolname AS role_name,
8 r.rolsuper AS is_superuser,
9 r.rolinherit AS inherits_privileges,
10 r.rolcreaterole AS can_create_roles,
11 r.rolcreatedb AS can_create_db,
12 r.rolcanlogin AS can_login,
13 r.rolreplication AS can_replication,
14 r.rolconnlimit AS connection_limit,
15 r.rolvaliduntil AS valid_until,
16 ARRAY(
17 SELECT b.rolname
18 FROM pg_auth_members m
19 JOIN pg_roles b ON (m.roleid = b.oid)
20 WHERE m.member = r.oid
21 ) AS member_of
22FROM pg_roles r;\ No newline at end of file
databases/passwords/mysql/README.org added +76
@@ -0,0 +1,76 @@
1#+title: MySQL Passwords
2
3* =mysql_admins.sql=
4
5#+begin_src sql
6SELECT user, host, plugin FROM mysql.user;
7#+end_src
8
9#+begin_src
10mysql> SELECT user, host, plugin FROM mysql.user;
11+------------------+-----------+-----------------------+
12| user | host | plugin |
13+------------------+-----------+-----------------------+
14| cmc | % | caching_sha2_password |
15| mysql.infoschema | localhost | caching_sha2_password |
16| mysql.session | localhost | caching_sha2_password |
17| mysql.sys | localhost | caching_sha2_password |
18| root | localhost | caching_sha2_password |
19+------------------+-----------+-----------------------+
205 rows in set (0.001 sec)
21#+end_src
22
23#+begin_src sql
24SHOW GLOBAL VARIABLES LIKE 'validate_password%';
25SHOW VARIABLES LIKE 'validate_password%';
26#+end_src
27
28#+begin_src
29mysql> SHOW GLOBAL VARIABLES LIKE 'validate_password%';
30+-------------------------------------------------+--------+
31| Variable_name | Value |
32+-------------------------------------------------+--------+
33| validate_password.changed_characters_percentage | 0 |
34| validate_password.check_user_name | ON |
35| validate_password.dictionary_file | |
36| validate_password.length | 8 |
37| validate_password.mixed_case_count | 1 |
38| validate_password.number_count | 1 |
39| validate_password.policy | MEDIUM |
40| validate_password.special_char_count | 1 |
41+-------------------------------------------------+--------+
428 rows in set (0.004 sec)
43
44mysql> SHOW VARIABLES LIKE 'validate_password%';
45+-------------------------------------------------+--------+
46| Variable_name | Value |
47+-------------------------------------------------+--------+
48| validate_password.changed_characters_percentage | 0 |
49| validate_password.check_user_name | ON |
50| validate_password.dictionary_file | |
51| validate_password.length | 8 |
52| validate_password.mixed_case_count | 1 |
53| validate_password.number_count | 1 |
54| validate_password.policy | MEDIUM |
55| validate_password.special_char_count | 1 |
56+-------------------------------------------------+--------+
578 rows in set (0.004 sec)
58#+end_src
59
60#+begin_src sql
61SELECT * FROM mysql.user
62#+end_src
63
64#+begin_src
65MySQL [(none)]> SELECT * FROM mysql.user;
66+-----------+------------------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+--------------+------------+-----------------------+------------------+--------------+-----------------+------------------+------------------+----------------+---------------------+--------------------+------------------+------------+--------------+------------------------+----------+------------+-------------+--------------+---------------+-------------+-----------------+----------------------+-----------------------+------------------------------------------------------------------------+------------------+-----------------------+-------------------+----------------+------------------+----------------+------------------------+---------------------+--------------------------+-----------------+
67| Host | User | Select_priv | Insert_priv | Update_priv | Delete_priv | Create_priv | Drop_priv | Reload_priv | Shutdown_priv | Process_priv | File_priv | Grant_priv | References_priv | Index_priv | Alter_priv | Show_db_priv | Super_priv | Create_tmp_table_priv | Lock_tables_priv | Execute_priv | Repl_slave_priv | Repl_client_priv | Create_view_priv | Show_view_priv | Create_routine_priv | Alter_routine_priv | Create_user_priv | Event_priv | Trigger_priv | Create_tablespace_priv | ssl_type | ssl_cipher | x509_issuer | x509_subject | max_questions | max_updates | max_connections | max_user_connections | plugin | authentication_string | password_expired | password_last_changed | password_lifetime | account_locked | Create_role_priv | Drop_role_priv | Password_reuse_history | Password_reuse_time | Password_require_current | User_attributes |
68+-----------+------------------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+--------------+------------+-----------------------+------------------+--------------+-----------------+------------------+------------------+----------------+---------------------+--------------------+------------------+------------+--------------+------------------------+----------+------------+-------------+--------------+---------------+-------------+-----------------+----------------------+-----------------------+------------------------------------------------------------------------+------------------+-----------------------+-------------------+----------------+------------------+----------------+------------------------+---------------------+--------------------------+-----------------+
69| % | cmc | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | | | | | 0 | 0 | 0 | 0 | caching_sha2_password | | N | 2025-04-25 16:28:52 | NULL | N | N | N | NULL | NULL | NULL | NULL |
70| localhost | mysql.infoschema | Y | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | | | | | 0 | 0 | 0 | 0 | caching_sha2_password | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED | N | 2025-04-25 15:51:53 | NULL | Y | N | N | NULL | NULL | NULL | NULL |
71| localhost | mysql.session | N | N | N | N | N | N | N | Y | N | N | N | N | N | N | N | Y | N | N | N | N | N | N | N | N | N | N | N | N | N | | | | | 0 | 0 | 0 | 0 | caching_sha2_password | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED | N | 2025-04-25 15:51:53 | NULL | Y | N | N | NULL | NULL | NULL | NULL |
72| localhost | mysql.sys | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | | | | | 0 | 0 | 0 | 0 | caching_sha2_password | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED | N | 2025-04-25 15:51:53 | NULL | Y | N | N | NULL | NULL | NULL | NULL |
73| localhost | root | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | | | | | 0 | 0 | 0 | 0 | caching_sha2_password | | N | 2025-04-25 15:51:53 | NULL | N | Y | Y | NULL | NULL | NULL | NULL |
74+-----------+------------------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+--------------+------------+-----------------------+------------------+--------------+-----------------+------------------+------------------+----------------+---------------------+--------------------+------------------+------------+--------------+------------------------+----------+------------+-------------+--------------+---------------+-------------+-----------------+----------------------+-----------------------+------------------------------------------------------------------------+------------------+-----------------------+-------------------+----------------+------------------+----------------+------------------------+---------------------+--------------------------+-----------------+
755 rows in set (0.005 sec)
76#+end_src
databases/passwords/mysql/passwords.sql added +13
@@ -0,0 +1,13 @@
1-- NOTE: Please review the server's "my.cnf" file for default values;
2-- OR: run the "SHOW [GLOBAL | SESSION] VARIABLES" command(s) on the database.
3
4-- Authentication methods only
5SELECT user, host, plugin FROM mysql.user;
6
7-- Default password configuration only
8SHOW GLOBAL VARIABLES LIKE 'validate_password%';
9SHOW VARIABLES LIKE 'validate_password%';
10
11-- Authentication methods and MySQL password configurations
12-- Reference: https://mariadb.com/kb/en/mysql-user-table/
13SELECT * FROM mysql.user
databases/passwords/postgres/README.org added +31
@@ -0,0 +1,31 @@
1#+title: Postgres Passwords
2
3* =passwords.sql=
4
5#+begin_src sql
6SELECT *
7FROM pg_settings
8WHERE name LIKE 'password_%';
9#+end_src
10
11#+begin_src
12| name | setting | unit | category | short_desc | extra_desc | context | vartype | source | min_val | max_val | enumvals | boot_val | reset_val | sourcefile | sourceline | pending_restart |
13|---------------------+---------------+------+-------------------------------------------------+-------------------------------------------------+------------+---------+---------+---------+---------+---------+---------------------+---------------+---------------+------------+------------+-----------------|
14| password_encryption | scram-sha-256 | | Connections and Authentication / Authentication | Chooses the algorithm for encrypting passwords. | | user | enum | default | | | {md5,scram-sha-256} | scram-sha-256 | scram-sha-256 | | | false |
15#+end_src
16
17#+begin_src sql
18SELECT
19 usename AS user_name,
20 passwd AS password,
21 valuntil AS valid_until,
22 useconfig AS user_config
23FROM pg_shadow;
24#+end_src
25
26#+begin_src
27| user_name | password | valid_until | user_config |
28|-----------+---------------------------------------------------------------------------------------------------------------------------------------+------------------------+-------------|
29| cmc | | | |
30| testuser | SCRAM-SHA-256$4096:+NSpEU+8afhJ4BUTkzdKeg==$FGIRcTWr89b42qkLUl4Ntfp4RUpoc3GIpLHqJl/fWZE=:o1UM8YiEj5SLV5l/geMuqXMRi6onWazryn/l+LXYMxU= | 2025-12-31 00:00:00-06 | |
31#+end_src
databases/passwords/postgres/passwords.sql added +18
@@ -0,0 +1,18 @@
1-- References:
2-- : https://www.postgresql.org/docs/current/view-pg-shadow.html
3-- : https://www.postgresql.org/docs/current/auth-password.html
4-- : https://www.postgresql.org/docs/current/auth-password.html#AUTH-PASSWORD-ENCRYPTION
5-- : https://www.postgresql.org/docs/current/runtime-config.html
6
7-- Defined password configuration
8SELECT *
9FROM pg_settings
10WHERE name LIKE 'password_%';
11
12-- Users and their password configurations
13SELECT
14 usename AS user_name,
15 passwd AS password,
16 valuntil AS valid_until,
17 useconfig AS user_config
18FROM pg_shadow;\ No newline at end of file