search

RAKWireless / rak_common_for_gateway

214 stars 124 forks source link

fix: store password as scram-sha-256 #99

Open tomohirohiratsuka opened 1 month ago

tomohirohiratsuka commented 1 month ago

Hi,

I encountered an issue during the installation process where the chirpstack_as and chirpstack_ns roles cannot access PostgreSQL. The problem appears to be related to password encryption methods.

The shell script expects the role passwords to be md5 encrypted. However, the RPi OS Bookworm installs PostgreSQL 15 by default, as shown below:

apt-cache policy postgresql
postgresql:
  Installed: 15+248
  Candidate: 15+248
  Version table:
 *** 15+248 500
        500 http://deb.debian.org/debian bookworm/main arm64 Packages
        500 http://deb.debian.org/debian bookworm/main armhf Packages
        100 /var/lib/dpkg/status

PostgreSQL 15 uses scram-sha-256 as the default encryption method. https://www.postgresql.org/docs/15/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION

However, the init_sql.sql script sets the password using md5 encryption: https://github.com/RAKWireless/rak_common_for_gateway/blob/master/chirpstack/init_sql.sql#L15

To address this inconsistency, there are two potential solutions:

Specify the PostgreSQL version to one that uses md5 encryption by default. Update the password storage method to scram-sha-256 to match the latest PostgreSQL version. This PR aims to set the role passwords using scram-sha-256 encryption. I would appreciate the maintainers' opinions on this approach.

Thank you.