Changing Postgres user password hashing algorithm from MD5 to SCRAM-SHA-256

About this task

Use this procedure to change from the default MD5 hashing algorithm to SCRAM-SHA-256 password hashing algorithm by using the SetDbPasswordAndHashingAlgorithm.sh script.

Note:

Prior to running the SetDbPasswordAndHashingAlgorithm.sh script, the SetDbPassword.sh script has to be run to change the default postgres user database account. The following services are restarted when the SetDbPassword.sh script is executed and again when the SetDbPasswordAndHashingAlgorithm.sh script is run. Hence, do not run the script unless a scheduled maintenance window is set to accommodate both service restarts.

postgressql
vpms
mmserver
avpSNMPAgentSvc

Procedure

Log on to the local Linux console as root.

Note:

Only a root user can execute the script.
Navigate to the /opt/Avaya/ExperiencePortal/Support/Security-Tools/ directory.
Run the SetDbPassword.sh script to modify the default postgres database user account.
1. Enter the bash SetDbPassword.sh update -u postgres command.
2. Enter in the password when prompted.
  
  Ensure that you remember the password as you will have to enter it again later.
3. Select Y to restart services.
Enter the Bash SetDbPasswordAndHashingAlgorithm.sh command.

Select the password hashing algorithm that you want to apply to the Postgres database.

The options are:

MD5
SCRAM-SHA-256

Once you select the password hashing algorithm, the script displays the process it goes through.

	Note:
	You are prompted to enter the postgres user account password three times to facilitate the changing of the password to the new hashing algorithm.

Example of a sample output:

Please select the postgres hashing algorithm to set
  		1) md5
  		2) scram-sha-2562
2   [In this case Option 2 was selected]
Postgres will be set to use scram-sha-256 password hashing
Changing the pg_hba.conf file to scram-sha-256 hashing algorithm
Reloading the postgresql configuration file to reflect changes made
0
Enter in the postgres user account password:
Enter Password: 
Enter in the postgres user account password again:
Enter Password: 
Updating the postgres default user account password
ALTER ROLE
Running the SetDbPassword.sh for the postgres account - Enter in password again
Please enter the password:

Next Steps

The postgres user account is changed automatically when you run the script. Any additional postgres user accounts will have to be changed manually using the existing SetDbPassword.sh script provided.

	Note:
	Only a root user can execute the script.