{"kind": "auth", "major": "18", "item": {"slug": "password", "name": "password", "name_zh": "", "category": "\u5bc6\u7801\u8ba4\u8bc1", "summary": "\u8981\u6c42\u5ba2\u6237\u7aef\u63d0\u4f9b\u672a\u7ecf\u52a0\u5bc6\u7684\u5bc6\u7801\u8fdb\u884c\u8ba4\u8bc1\u3002\u7531\u4e8e\u5bc6\u7801\u901a\u8fc7\u7f51\u7edc\u660e\u6587\u4f20\u8f93\uff0c\u4e0d\u5e94\u5728\u4e0d\u53ef\u4fe1\u7f51\u7edc\u4e0a\u4f7f\u7528\u3002\u8be6\u60c5\u53c2\u89c1\u7b2c 20.5 \u8282\u3002", "aliases": [], "content_hash": "26675659120323e01a609c9a4fe45b6ae1370defd0802e432767d88f03640c0d", "versions": {"10": {"facts": [{"label": "\u65b9\u6cd5", "value": "password"}, {"label": "\u914d\u7f6e", "value": "pg_hba.conf"}, {"label": "\u6e05\u5355", "value": "\u7528\u6237\u53ef\u89c1\u7684\u6e90\u7801\u8ba4\u8bc1\u65b9\u6cd5"}], "tables": [{"key": "method-options", "rows": [{"name": "scram-sha-256", "description": "scram-sha-256 \u65b9\u6cd5\u6267\u884c SCRAM-SHA-256 \u8ba4\u8bc1\uff0c\u5176\u5b9a\u4e49\u89c1 RFC 7677 \u3002\u5b83\u662f\u4e00\u79cd\u6311\u6218-\u54cd\u5e94\u65b9\u6848\uff0c\u53ef\u9632\u6b62\u5728\u4e0d\u53d7\u4fe1\u4efb\u8fde\u63a5\u4e0a\u55c5\u63a2\u5bc6\u7801\uff0c\u5e76\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u88ab\u8ba4\u4e3a\u5b89\u5168\u7684\u5bc6\u7801\u5b66 hash \u5f62\u5f0f\u5b58\u50a8\u5bc6\u7801\u3002 \u8fd9\u662f\u5f53\u524d\u63d0\u4f9b\u7684\u65b9\u6cd5\u4e2d\u6700\u5b89\u5168\u7684\u4e00\u79cd\uff0c\u4f46\u662f\u65e7\u7684\u5ba2\u6237\u7aef\u5e93\u4e0d\u652f\u6301\u8fd9\u79cd\u65b9\u6cd5\u3002"}, {"name": "md5", "description": "md5 \u65b9\u6cd5\u4f7f\u7528\u81ea\u5b9a\u4e49\u4e14\u5b89\u5168\u6027\u8f83\u5f31\u7684\u6311\u6218\u54cd\u5e94\u673a\u5236\u3002\u5b83\u80fd\u9632\u6b62\u5bc6\u7801\u55c5\u63a2\uff0c\u907f\u514d\u670d\u52a1\u5668\u660e\u6587\u5b58\u50a8\u5bc6\u7801\uff1b\u4f46\u653b\u51fb\u8005\u4e00\u65e6\u7a83\u53d6\u670d\u52a1\u5668\u4e0a\u7684\u5bc6\u7801\u54c8\u5e0c\uff0c\u5c31\u65e0\u6cd5\u63d0\u4f9b\u4fdd\u62a4\u3002\u6b64\u5916\uff0cMD5 \u54c8\u5e0c\u7b97\u6cd5\u5982\u4eca\u5df2\u4e0d\u518d\u88ab\u8ba4\u4e3a\u80fd\u5b89\u5168\u62b5\u5fa1\u6709\u9488\u5bf9\u6027\u7684\u653b\u51fb\u3002md5 \u65b9\u6cd5\u4e0d\u80fd\u4e0e db_user_namespace \u529f\u80fd\u4e00\u8d77\u4f7f\u7528\u3002\u4e3a\u4fbf\u4e8e\u4ece md5 \u8fc1\u79fb\u5230\u8f83\u65b0\u7684 SCRAM \u65b9\u6cd5\uff0c\u5982\u679c pg_hba.conf \u4e2d\u6307\u5b9a md5\uff0c\u4f46\u670d\u52a1\u5668\u4e0a\u8be5\u7528\u6237\u7684\u5bc6\u7801\u91c7\u7528 SCRAM \u52a0\u5bc6\u5b58\u50a8\uff08\u89c1\u4e0b\u6587\uff09\uff0c\u7cfb\u7edf\u4f1a\u81ea\u52a8\u6539\u7528\u57fa\u4e8e SCRAM \u7684\u8ba4\u8bc1\u3002"}, {"name": "password", "description": "\u65b9\u6cd5 password \u4ee5\u660e\u6587\u5f62\u5f0f\u53d1\u9001\u5bc6\u7801\uff0c\u56e0\u6b64\u5b83\u5bb9\u6613\u53d7\u5230\u5bc6\u7801 \u201c \u55c5\u63a2 \u201d \u653b\u51fb\u3002\u5982\u679c\u53ef\u80fd\u5e94\u8be5\u5c3d\u91cf\u907f\u514d\u4f7f\u7528\u5b83\u3002\u4e0d\u8fc7\uff0c\u5982\u679c\u8fde\u63a5\u88abSSL\u52a0\u5bc6\u4fdd\u62a4\u7740\uff0c\u90a3\u4e48\u53ef\u4ee5\u5b89\u5168\u5730\u4f7f\u7528 password \uff08\u4e0d\u8fc7\u5982\u679c\u4f9d\u9760SSL\uff0cSSL\u8bc1\u4e66\u8ba4\u8bc1\u53ef\u80fd\u662f\u66f4\u597d\u7684\u9009\u62e9\uff09\u3002"}], "title": "\u624b\u518c\u4e2d\u7684\u65b9\u6cd5\u9009\u9879\u4e0e\u66ff\u4ee3\u65b9\u5f0f", "columns": [{"key": "name", "label": "\u9009\u9879\u6216\u672f\u8bed"}, {"key": "description", "label": "\u542b\u4e49"}]}], "aliases": [], "related": [], "release": {"ref": "https://ftp.postgresql.org/pub/source/v10.23/postgresql-10.23.tar.bz2", "label": "10.23", "major": "10", "channel": "historical", "revision": "94a4b2528372458e5662c18d406629266667c437198160a18cdfd2c4a4d6eee9", "source_sha256": "94a4b2528372458e5662c18d406629266667c437198160a18cdfd2c4a4d6eee9", "catalog_fingerprint": "691be281b476dde4374d7f805b2bacc2e75bdef40f1e9d3d42e91f97fe95cfd0"}, "sources": [{"url": "https://ftp.postgresql.org/pub/source/v10.23/postgresql-10.23.tar.bz2", "label": "Matching PostgreSQL source archive", "sha256": "94a4b2528372458e5662c18d406629266667c437198160a18cdfd2c4a4d6eee9"}, {"url": "https://pg.center/docs/10/auth-methods.html#AUTH-PASSWORD", "path": "auth-methods.html", "label": "PostgreSQL 10 English manual", "sha256": "856d36a3fdfe8c45a25832e49bd07e9b7480f2ff9a33e58ac7c392630149bc34", "language": "en", "original_url": "/docs/10/auth-methods.html#AUTH-PASSWORD"}, {"url": "https://pg.center/docs/10/auth-pg-hba-conf.html", "path": "auth-pg-hba-conf.html", "label": "PostgreSQL 10 English manual", "sha256": "04fed609a50e8fd3013ffebb83039c544d39b6c73a6c2b2e23cd7864a70b42da", "language": "en", "original_url": "/docs/10/auth-pg-hba-conf.html"}], "sections": [], "signature": "", "attributes": {"method": "password", "inventory": "User-visible source authentication method", "configuration": "pg_hba.conf"}, "description": ["\u8981\u6c42\u5ba2\u6237\u7aef\u63d0\u4f9b\u672a\u7ecf\u52a0\u5bc6\u7684\u5bc6\u7801\u8fdb\u884c\u8ba4\u8bc1\u3002\u7531\u4e8e\u5bc6\u7801\u901a\u8fc7\u7f51\u7edc\u660e\u6587\u4f20\u8f93\uff0c\u4e0d\u5e94\u5728\u4e0d\u53ef\u4fe1\u7f51\u7edc\u4e0a\u4f7f\u7528\u3002\u8be6\u60c5\u53c2\u89c1\u7b2c 20.3.2 \u8282\u3002"], "manual_html": "<div class=\"sect2\" id=\"AUTH-PASSWORD\">\n<div class=\"titlepage\">\n<div>\n<div>\n<h3 class=\"title\" lang=\"zh\"><span class=\"sect2\"><a href=\"/docs/10/auth-methods.html#AUTH-PASSWORD\">20.3.2. \u5bc6\u7801\u8ba4\u8bc1</a></span></h3>\n</div>\n</div>\n</div>\n<p lang=\"zh\">\u6709\u51e0\u79cd\u57fa\u4e8e\u5bc6\u7801\u7684\u8ba4\u8bc1\u65b9\u6cd5\u3002\u8fd9\u4e9b\u65b9\u6cd5\u7684\u8fc7\u7a0b\u7c7b\u4f3c\uff0c\u4f46\u662f\u533a\u522b\u5728\u4e8e\u7528\u6237\u5bc6\u7801\u5982\u4f55\u88ab\u5b58\u653e\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u53ca\u5ba2\u6237\u7aef\u63d0\u4f9b\u7684\u5bc6\u7801\u5982\u4f55\u88ab\u901a\u8fc7\u8fde\u63a5\u53d1\u9001\u3002</p>\n<div class=\"variablelist\">\n<dl class=\"variablelist\">\n<dt><span class=\"term\"><code class=\"literal\">scram-sha-256</code></span></dt>\n<dd>\n<p lang=\"zh\"><code class=\"literal\">scram-sha-256</code> \u65b9\u6cd5\u6267\u884c SCRAM-SHA-256 \u8ba4\u8bc1\uff0c\u5176\u5b9a\u4e49\u89c1 <a class=\"ulink\" href=\"https://tools.ietf.org/html/rfc7677\" target=\"_top\">RFC 7677</a>\u3002\u5b83\u662f\u4e00\u79cd\u6311\u6218-\u54cd\u5e94\u65b9\u6848\uff0c\u53ef\u9632\u6b62\u5728\u4e0d\u53d7\u4fe1\u4efb\u8fde\u63a5\u4e0a\u55c5\u63a2\u5bc6\u7801\uff0c\u5e76\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u88ab\u8ba4\u4e3a\u5b89\u5168\u7684\u5bc6\u7801\u5b66 hash \u5f62\u5f0f\u5b58\u50a8\u5bc6\u7801\u3002</p>\n<p lang=\"zh\">\u8fd9\u662f\u5f53\u524d\u63d0\u4f9b\u7684\u65b9\u6cd5\u4e2d\u6700\u5b89\u5168\u7684\u4e00\u79cd\uff0c\u4f46\u662f\u65e7\u7684\u5ba2\u6237\u7aef\u5e93\u4e0d\u652f\u6301\u8fd9\u79cd\u65b9\u6cd5\u3002</p>\n</dd>\n<dt><span class=\"term\"><code class=\"literal\">md5</code></span></dt>\n<dd>\n<p lang=\"zh\">\u65b9\u6cd5<code class=\"literal\">md5</code>\u4f7f\u7528\u4e00\u79cd\u81ea\u5b9a\u4e49\u7684\u3001\u5b89\u5168\u6027\u8f83\u4f4e\u7684\u6311\u6218-\u54cd\u5e94\u673a\u5236\u3002\u5b83\u80fd\u9632\u6b62\u5bc6\u7801\u55c5\u63a2\uff0c\u5e76\u907f\u514d\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u660e\u6587\u5b58\u50a8\u5bc6\u7801\uff1b\u4f46\u5982\u679c\u653b\u51fb\u8005\u8bbe\u6cd5\u4ece\u670d\u52a1\u5668\u4e0a\u7a83\u53d6\u4e86\u5bc6\u7801 hash\uff0c\u5b83\u5c31\u65e0\u6cd5\u63d0\u4f9b\u4fdd\u62a4\u3002\u6b64\u5916\uff0c\u5982\u4eca\u5df2\u4e0d\u518d\u8ba4\u4e3a MD5 hash \u7b97\u6cd5\u80fd\u62b5\u5fa1\u6709\u51b3\u5fc3\u7684\u653b\u51fb\u8005\u3002</p>\n<p lang=\"zh\"><code class=\"literal\">md5</code>\u65b9\u6cd5\u4e0d\u80fd\u4e0e<a class=\"xref\" href=\"/docs/10/runtime-config-connection.html#GUC-DB-USER-NAMESPACE\">db_user_namespace</a>\u529f\u80fd\u4e00\u8d77\u4f7f\u7528\u3002</p>\n<p lang=\"zh\">\u4e3a\u4fbf\u4e8e\u4ece md5 \u8fc1\u79fb\u5230\u8f83\u65b0\u7684 SCRAM \u65b9\u6cd5\uff0c\u5982\u679c pg_hba.conf \u4e2d\u6307\u5b9a md5\uff0c\u4f46\u670d\u52a1\u5668\u4e0a\u8be5\u7528\u6237\u7684\u5bc6\u7801\u91c7\u7528 SCRAM \u52a0\u5bc6\u5b58\u50a8\uff08\u89c1\u4e0b\u6587\uff09\uff0c\u7cfb\u7edf\u4f1a\u81ea\u52a8\u6539\u7528\u57fa\u4e8e SCRAM \u7684\u8ba4\u8bc1\u3002</p>\n</dd>\n<dt><span class=\"term\"><code class=\"literal\">password</code></span></dt>\n<dd>\n<p lang=\"zh\">\n<p>\u65b9\u6cd5<code class=\"literal\">password</code>\u4ee5\u660e\u6587\u5f62\u5f0f\u53d1\u9001\u5bc6\u7801\uff0c\u56e0\u6b64\u5b83\u5bb9\u6613\u53d7\u5230\u5bc6\u7801<span class=\"quote\">\u201c<span class=\"quote\">\u55c5\u63a2</span>\u201d</span>\u653b\u51fb\u3002\u5982\u679c\u53ef\u80fd\u5e94\u8be5\u5c3d\u91cf\u907f\u514d\u4f7f\u7528\u5b83\u3002\u4e0d\u8fc7\uff0c\u5982\u679c\u8fde\u63a5\u88abSSL\u52a0\u5bc6\u4fdd\u62a4\u7740\uff0c\u90a3\u4e48\u53ef\u4ee5\u5b89\u5168\u5730\u4f7f\u7528<code class=\"literal\">password</code>\uff08\u4e0d\u8fc7\u5982\u679c\u4f9d\u9760SSL\uff0cSSL\u8bc1\u4e66\u8ba4\u8bc1\u53ef\u80fd\u662f\u66f4\u597d\u7684\u9009\u62e9\uff09\u3002</p>\n</p>\n</dd>\n</dl>\n</div>\n<p lang=\"zh\"><span class=\"productname\">PostgreSQL</span> \u6570\u636e\u5e93\u5bc6\u7801\u72ec\u7acb\u4e8e\u64cd\u4f5c\u7cfb\u7edf\u7528\u6237\u5bc6\u7801\u3002\u6bcf\u4e2a\u6570\u636e\u5e93\u7528\u6237\u7684\u5bc6\u7801\u5b58\u50a8\u5728 <code class=\"literal\">pg_authid</code> \u7cfb\u7edf\u76ee\u5f55\u4e2d\u3002\u53ef\u4ee5\u4f7f\u7528 SQL \u547d\u4ee4<a class=\"xref\" href=\"/docs/10/sql-createuser.html\" title=\"CREATE USER\"><span class=\"refentrytitle\">CREATE USER</span></a>\u548c<a class=\"xref\" href=\"/docs/10/sql-alterrole.html\" title=\"ALTER ROLE\"><span class=\"refentrytitle\">ALTER ROLE</span></a>\u7ba1\u7406\u5bc6\u7801\uff0c\u4f8b\u5982 <strong class=\"userinput\"><code>CREATE USER foo WITH PASSWORD 'secret'</code></strong>\uff0c\u4e5f\u53ef\u4ee5\u4f7f\u7528 <span class=\"application\">psql</span> \u547d\u4ee4 <code class=\"literal\">\\password</code>\u3002\u5982\u679c\u672a\u4e3a\u67d0\u4e2a\u7528\u6237\u8bbe\u7f6e\u5bc6\u7801\uff0c\u5b58\u50a8\u7684\u5bc6\u7801\u5c31\u662f\u7a7a\u503c\uff0c\u8be5\u7528\u6237\u7684\u5bc6\u7801\u8ba4\u8bc1\u59cb\u7ec8\u4f1a\u5931\u8d25\u3002</p>\n<p lang=\"zh\">\u4e0d\u540c\u57fa\u4e8e\u5bc6\u7801\u7684\u8ba4\u8bc1\u65b9\u6cd5\u662f\u5426\u53ef\u7528\uff0c\u53d6\u51b3\u4e8e\u7528\u6237\u5728\u670d\u52a1\u5668\u4e0a\u7684\u5bc6\u7801\u662f\u5982\u4f55\u52a0\u5bc6\u7684\uff08\u66f4\u51c6\u786e\u5730\u8bf4\uff0c\u662f\u5982\u4f55\u8fdb\u884c hash \u8fd0\u7b97\u7684\uff09\u3002\u8fd9\u7531\u8bbe\u7f6e\u5bc6\u7801\u65f6\u7684\u914d\u7f6e\u53c2\u6570<a class=\"xref\" href=\"/docs/10/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION\">password_encryption</a>\u63a7\u5236\u3002\u5982\u679c\u5bc6\u7801\u662f\u4f7f\u7528 <code class=\"literal\">scram-sha-256</code> \u8bbe\u7f6e\u52a0\u5bc6\u7684\uff0c\u90a3\u4e48\u5b83\u53ef\u4ee5\u7528\u4e8e <code class=\"literal\">scram-sha-256</code> \u548c <code class=\"literal\">password</code> \u8ba4\u8bc1\u65b9\u6cd5\uff08\u4f46\u540e\u4e00\u79cd\u60c5\u51b5\u4e0b\u5bc6\u7801\u4f1a\u4ee5\u660e\u6587\u4f20\u8f93\uff09\u3002\u5982\u4e0a\u6240\u8ff0\uff0c\u6b64\u65f6\u5982\u679c\u8ba4\u8bc1\u65b9\u6cd5\u6307\u5b9a\u4e3a <code class=\"literal\">md5</code>\uff0c\u4e5f\u4f1a\u81ea\u52a8\u5207\u6362\u4e3a\u4f7f\u7528 <code class=\"literal\">scram-sha-256</code>\uff0c\u56e0\u6b64\u540c\u6837\u80fd\u591f\u5de5\u4f5c\u3002\u5982\u679c\u5bc6\u7801\u662f\u4f7f\u7528 <code class=\"literal\">md5</code> \u8bbe\u7f6e\u52a0\u5bc6\u7684\uff0c\u90a3\u4e48\u5b83\u53ea\u80fd\u7528\u4e8e <code class=\"literal\">md5</code> \u548c <code class=\"literal\">password</code> \u8ba4\u8bc1\u65b9\u6cd5\uff08\u540c\u6837\uff0c\u540e\u4e00\u79cd\u60c5\u51b5\u4e0b\u5bc6\u7801\u4f1a\u4ee5\u660e\u6587\u4f20\u8f93\uff09\u3002\uff08\u4ee5\u524d\u7684 PostgreSQL \u7248\u672c\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u5b58\u50a8\u660e\u6587\u5bc6\u7801\uff0c\u4f46\u73b0\u5728\u5df2\u7ecf\u4e0d\u518d\u53ef\u80fd\u3002\uff09\u8981\u68c0\u67e5\u5f53\u524d\u5b58\u50a8\u7684\u5bc6\u7801 hash\uff0c\u53ef\u4ee5\u67e5\u770b\u7cfb\u7edf\u76ee\u5f55 <code class=\"literal\">pg_authid</code>\u3002</p>\n<p lang=\"zh\">\u8981\u5c06\u73b0\u6709\u5b89\u88c5\u4ece md5 \u5347\u7ea7\u5230 scram-sha-256\uff0c\u5e94\u5148\u786e\u8ba4\u6240\u6709\u4f7f\u7528\u4e2d\u7684\u5ba2\u6237\u7aef\u5e93\u7248\u672c\u90fd\u652f\u6301 SCRAM\uff1b\u7136\u540e\u5728 postgresql.conf \u4e2d\u8bbe\u7f6e password_encryption = 'scram-sha-256'\uff0c\u8ba9\u6240\u6709\u7528\u6237\u91cd\u65b0\u8bbe\u7f6e\u5bc6\u7801\uff0c\u5e76\u5c06 pg_hba.conf \u4e2d\u7684\u8ba4\u8bc1\u65b9\u6cd5\u6539\u4e3a scram-sha-256\u3002</p>\n</div>", "manual_path": "/docs/10/auth-methods.html#AUTH-PASSWORD", "localization": {"status": "complete", "sources": [{"url": "/docs/10/auth-methods.html", "method": "same-major semantic node", "sha256": "128b4f29cf06d6bde5b9e357daacb6d538044ee392e4aece0e31c90b0a37b647", "language": "zh", "matched_nodes": ["#AUTH-METHODS/div[1]/dl[0]/dt[1]", "#AUTH-METHODS/div[4]/div[5]/dl[0]/dd[1]", "#AUTH-METHODS/div[4]/div[5]/dl[0]/dd[1]/p[0]", "#AUTH-METHODS/div[4]/div[5]/dl[0]/dd[1]/p[1]", "#AUTH-METHODS/div[4]/div[5]/dl[0]/dd[3]/p[0]", "#AUTH-METHODS/div[4]/div[5]/dl[0]/dd[3]/p[1]", "#AUTH-METHODS/div[4]/div[5]/dl[0]/dd[5]", "#AUTH-METHODS/div[4]/p[4]", "#AUTH-METHODS/div[4]/p[6]", "#AUTH-METHODS/div[4]/p[7]"]}], "language": "zh", "original_text": {"/versions/10/description/0": "Require the client to supply an unencrypted password for authentication. Since the password is sent in clear text over the network, this should not be used on untrusted networks. See Section 20.3.2 for details.", "/versions/10/facts/0/label": "Method", "/versions/10/facts/1/label": "Configuration", "/versions/10/facts/2/label": "Inventory", "/versions/10/facts/2/value": "User-visible source authentication method", "/versions/10/tables/0/title": "Documented method options and alternatives", "/versions/10/tables/0/columns/0/label": "Option or term", "/versions/10/tables/0/columns/1/label": "Meaning", "/versions/10/tables/0/rows/0/description": "The method scram-sha-256 performs SCRAM-SHA-256 authentication, as described in RFC 7677 . It is a challenge-response scheme that prevents password sniffing on untrusted connections and supports storing passwords on the server in a cryptographically hashed form that is thought to be secure. This is the most secure of the currently provided methods, but it is not supported by older client libraries.", "/versions/10/tables/0/rows/1/description": "The method md5 uses a custom less secure challenge-response mechanism. It prevents password sniffing and avoids storing passwords on the server in plain text but provides no protection if an attacker manages to steal the password hash from the server. Also, the MD5 hash algorithm is nowadays no longer considered secure against determined attacks. The md5 method cannot be used with the db_user_namespace feature. To ease transition from the md5 method to the newer SCRAM method, if md5 is specified as a method in pg_hba.conf but the user's password on the server is encrypted for SCRAM (see below), then SCRAM-based authentication will automatically be chosen instead.", "/versions/10/tables/0/rows/2/description": "The method password sends the password in clear-text and is therefore vulnerable to password \u201c sniffing \u201d attacks. It should always be avoided if possible. If the connection is protected by SSL encryption then password can be used safely, though. (Though SSL certificate authentication might be a better choice if one is depending on using SSL)."}, "fallback_fields": [], "source_language": "en", "original_snapshot_sha256": "61a45c4fdfca39d0546f784aea23a9b77be1aa62ef26040d64c2744532731b22"}, "comparison_data": {"method": "password", "documented_option_names": ["md5", "password", "scram-sha-256"]}, "comparison_hash": "d4a07ed4f297699ecd061181bcc656e57ea443c94b1d7536a172c08865099daf", "manual_language": "zh"}, "11": {"facts": [{"label": "\u65b9\u6cd5", "value": "password"}, {"label": "\u914d\u7f6e", "value": "pg_hba.conf"}, {"label": "\u6e05\u5355", "value": "\u7528\u6237\u53ef\u89c1\u7684\u6e90\u7801\u8ba4\u8bc1\u65b9\u6cd5"}], "tables": [{"key": "method-options", "rows": [{"name": "scram-sha-256", "description": "scram-sha-256 \u65b9\u6cd5\u6267\u884c SCRAM-SHA-256 \u8ba4\u8bc1\uff0c\u5176\u5b9a\u4e49\u89c1 RFC 7677 \u3002\u5b83\u662f\u4e00\u79cd\u6311\u6218-\u54cd\u5e94\u65b9\u6848\uff0c\u53ef\u9632\u6b62\u5728\u4e0d\u53d7\u4fe1\u4efb\u8fde\u63a5\u4e0a\u55c5\u63a2\u5bc6\u7801\uff0c\u5e76\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u88ab\u8ba4\u4e3a\u5b89\u5168\u7684\u5bc6\u7801\u5b66 hash \u5f62\u5f0f\u5b58\u50a8\u5bc6\u7801\u3002 \u8fd9\u662f\u5f53\u524d\u63d0\u4f9b\u7684\u65b9\u6cd5\u4e2d\u6700\u5b89\u5168\u7684\u4e00\u79cd\uff0c\u4f46\u662f\u65e7\u7684\u5ba2\u6237\u7aef\u5e93\u4e0d\u652f\u6301\u8fd9\u79cd\u65b9\u6cd5\u3002"}, {"name": "md5", "description": "md5 \u65b9\u6cd5\u4f7f\u7528\u81ea\u5b9a\u4e49\u4e14\u5b89\u5168\u6027\u8f83\u5f31\u7684\u6311\u6218\u54cd\u5e94\u673a\u5236\u3002\u5b83\u80fd\u9632\u6b62\u5bc6\u7801\u55c5\u63a2\uff0c\u907f\u514d\u670d\u52a1\u5668\u660e\u6587\u5b58\u50a8\u5bc6\u7801\uff1b\u4f46\u653b\u51fb\u8005\u4e00\u65e6\u7a83\u53d6\u670d\u52a1\u5668\u4e0a\u7684\u5bc6\u7801\u54c8\u5e0c\uff0c\u5c31\u65e0\u6cd5\u63d0\u4f9b\u4fdd\u62a4\u3002\u6b64\u5916\uff0cMD5 \u54c8\u5e0c\u7b97\u6cd5\u5982\u4eca\u5df2\u4e0d\u518d\u88ab\u8ba4\u4e3a\u80fd\u5b89\u5168\u62b5\u5fa1\u6709\u9488\u5bf9\u6027\u7684\u653b\u51fb\u3002md5 \u65b9\u6cd5\u4e0d\u80fd\u4e0e db_user_namespace \u529f\u80fd\u4e00\u8d77\u4f7f\u7528\u3002\u4e3a\u4fbf\u4e8e\u4ece md5 \u8fc1\u79fb\u5230\u8f83\u65b0\u7684 SCRAM \u65b9\u6cd5\uff0c\u5982\u679c pg_hba.conf \u4e2d\u6307\u5b9a md5\uff0c\u4f46\u670d\u52a1\u5668\u4e0a\u8be5\u7528\u6237\u7684\u5bc6\u7801\u91c7\u7528 SCRAM \u52a0\u5bc6\u5b58\u50a8\uff08\u89c1\u4e0b\u6587\uff09\uff0c\u7cfb\u7edf\u4f1a\u81ea\u52a8\u6539\u7528\u57fa\u4e8e SCRAM \u7684\u8ba4\u8bc1\u3002"}, {"name": "password", "description": "\u65b9\u6cd5 password \u4ee5\u660e\u6587\u5f62\u5f0f\u53d1\u9001\u5bc6\u7801\uff0c\u56e0\u6b64\u5b83\u5bb9\u6613\u53d7\u5230\u5bc6\u7801 \u201c \u55c5\u63a2 \u201d \u653b\u51fb\u3002\u5982\u679c\u53ef\u80fd\u5e94\u8be5\u5c3d\u91cf\u907f\u514d\u4f7f\u7528\u5b83\u3002\u4e0d\u8fc7\uff0c\u5982\u679c\u8fde\u63a5\u88abSSL\u52a0\u5bc6\u4fdd\u62a4\u7740\uff0c\u90a3\u4e48\u53ef\u4ee5\u5b89\u5168\u5730\u4f7f\u7528 password \uff08\u4e0d\u8fc7\u5982\u679c\u4f9d\u9760SSL\uff0cSSL\u8bc1\u4e66\u8ba4\u8bc1\u53ef\u80fd\u662f\u66f4\u597d\u7684\u9009\u62e9\uff09\u3002"}], "title": "\u624b\u518c\u4e2d\u7684\u65b9\u6cd5\u9009\u9879\u4e0e\u66ff\u4ee3\u65b9\u5f0f", "columns": [{"key": "name", "label": "\u9009\u9879\u6216\u672f\u8bed"}, {"key": "description", "label": "\u542b\u4e49"}]}], "aliases": [], "related": [], "release": {"ref": "https://ftp.postgresql.org/pub/source/v11.22/postgresql-11.22.tar.bz2", "label": "11.22", "major": "11", "channel": "historical", "revision": "2cb7c97d7a0d7278851bbc9c61f467b69c094c72b81740b751108e7892ebe1f0", "source_sha256": "2cb7c97d7a0d7278851bbc9c61f467b69c094c72b81740b751108e7892ebe1f0", "catalog_fingerprint": "8f21f4444b7f68923f4762af0eb7937fa2907026e91249483e79050de012c901"}, "sources": [{"url": "https://ftp.postgresql.org/pub/source/v11.22/postgresql-11.22.tar.bz2", "label": "Matching PostgreSQL source archive", "sha256": "2cb7c97d7a0d7278851bbc9c61f467b69c094c72b81740b751108e7892ebe1f0"}, {"url": "https://pg.center/docs/11/auth-password.html", "path": "auth-password.html", "label": "PostgreSQL 11 English manual", "sha256": "06b509f1ece73d71706f82a9287080f645cf29152dfe38a3063d9640ccea54a5", "language": "en", "original_url": "/docs/11/auth-password.html"}, {"url": "https://pg.center/docs/11/auth-pg-hba-conf.html", "path": "auth-pg-hba-conf.html", "label": "PostgreSQL 11 English manual", "sha256": "5477c61a002171f5b4c462052d91231c405f39d89d825faf71e52fbae358eef7", "language": "en", "original_url": "/docs/11/auth-pg-hba-conf.html"}], "sections": [], "signature": "", "attributes": {"method": "password", "inventory": "User-visible source authentication method", "configuration": "pg_hba.conf"}, "description": ["\u8981\u6c42\u5ba2\u6237\u7aef\u63d0\u4f9b\u672a\u7ecf\u52a0\u5bc6\u7684\u5bc6\u7801\u8fdb\u884c\u8ba4\u8bc1\u3002\u7531\u4e8e\u5bc6\u7801\u901a\u8fc7\u7f51\u7edc\u660e\u6587\u4f20\u8f93\uff0c\u4e0d\u5e94\u5728\u4e0d\u53ef\u4fe1\u7f51\u7edc\u4e0a\u4f7f\u7528\u3002\u8be6\u60c5\u53c2\u89c1\u7b2c 20.5 \u8282\u3002"], "manual_html": "<div class=\"sect1\" id=\"AUTH-PASSWORD\">\n<div class=\"titlepage\">\n<div>\n<div>\n<h2 class=\"title\" lang=\"zh\">\n<div>\n<div>\n<h2 class=\"title\" style=\"clear: both\">20.5.\u00a0\u5bc6\u7801\u8ba4\u8bc1 </h2>\n</div>\n</div>\n</h2>\n</div>\n</div>\n</div>\n<p lang=\"zh\">\u6709\u51e0\u79cd\u57fa\u4e8e\u5bc6\u7801\u7684\u8ba4\u8bc1\u65b9\u6cd5\u3002\u8fd9\u4e9b\u65b9\u6cd5\u7684\u8fc7\u7a0b\u7c7b\u4f3c\uff0c\u4f46\u662f\u533a\u522b\u5728\u4e8e\u7528\u6237\u5bc6\u7801\u5982\u4f55\u88ab\u5b58\u653e\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u53ca\u5ba2\u6237\u7aef\u63d0\u4f9b\u7684\u5bc6\u7801\u5982\u4f55\u88ab\u901a\u8fc7\u8fde\u63a5\u53d1\u9001\u3002</p>\n<div class=\"variablelist\">\n<dl class=\"variablelist\">\n<dt><span class=\"term\"><code class=\"literal\">scram-sha-256</code></span></dt>\n<dd>\n<p lang=\"zh\"><code class=\"literal\">scram-sha-256</code> \u65b9\u6cd5\u6267\u884c SCRAM-SHA-256 \u8ba4\u8bc1\uff0c\u5176\u5b9a\u4e49\u89c1 <a class=\"ulink\" href=\"https://tools.ietf.org/html/rfc7677\" target=\"_top\">RFC 7677</a>\u3002\u5b83\u662f\u4e00\u79cd\u6311\u6218-\u54cd\u5e94\u65b9\u6848\uff0c\u53ef\u9632\u6b62\u5728\u4e0d\u53d7\u4fe1\u4efb\u8fde\u63a5\u4e0a\u55c5\u63a2\u5bc6\u7801\uff0c\u5e76\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u88ab\u8ba4\u4e3a\u5b89\u5168\u7684\u5bc6\u7801\u5b66 hash \u5f62\u5f0f\u5b58\u50a8\u5bc6\u7801\u3002</p>\n<p lang=\"zh\">\u8fd9\u662f\u5f53\u524d\u63d0\u4f9b\u7684\u65b9\u6cd5\u4e2d\u6700\u5b89\u5168\u7684\u4e00\u79cd\uff0c\u4f46\u662f\u65e7\u7684\u5ba2\u6237\u7aef\u5e93\u4e0d\u652f\u6301\u8fd9\u79cd\u65b9\u6cd5\u3002</p>\n</dd>\n<dt><span class=\"term\"><code class=\"literal\">md5</code></span></dt>\n<dd>\n<p lang=\"zh\">\u65b9\u6cd5<code class=\"literal\">md5</code>\u4f7f\u7528\u4e00\u79cd\u81ea\u5b9a\u4e49\u7684\u3001\u5b89\u5168\u6027\u8f83\u4f4e\u7684\u6311\u6218-\u54cd\u5e94\u673a\u5236\u3002\u5b83\u80fd\u9632\u6b62\u5bc6\u7801\u55c5\u63a2\uff0c\u5e76\u907f\u514d\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u660e\u6587\u5b58\u50a8\u5bc6\u7801\uff1b\u4f46\u5982\u679c\u653b\u51fb\u8005\u8bbe\u6cd5\u4ece\u670d\u52a1\u5668\u4e0a\u7a83\u53d6\u4e86\u5bc6\u7801 hash\uff0c\u5b83\u5c31\u65e0\u6cd5\u63d0\u4f9b\u4fdd\u62a4\u3002\u6b64\u5916\uff0c\u5982\u4eca\u5df2\u4e0d\u518d\u8ba4\u4e3a MD5 hash \u7b97\u6cd5\u80fd\u62b5\u5fa1\u6709\u51b3\u5fc3\u7684\u653b\u51fb\u8005\u3002</p>\n<p lang=\"zh\"><code class=\"literal\">md5</code>\u65b9\u6cd5\u4e0d\u80fd\u4e0e<a class=\"xref\" href=\"/docs/11/runtime-config-connection.html#GUC-DB-USER-NAMESPACE\">db_user_namespace</a>\u529f\u80fd\u4e00\u8d77\u4f7f\u7528\u3002</p>\n<p lang=\"zh\">\u4e3a\u4fbf\u4e8e\u4ece md5 \u8fc1\u79fb\u5230\u8f83\u65b0\u7684 SCRAM \u65b9\u6cd5\uff0c\u5982\u679c pg_hba.conf \u4e2d\u6307\u5b9a md5\uff0c\u4f46\u670d\u52a1\u5668\u4e0a\u8be5\u7528\u6237\u7684\u5bc6\u7801\u91c7\u7528 SCRAM \u52a0\u5bc6\u5b58\u50a8\uff08\u89c1\u4e0b\u6587\uff09\uff0c\u7cfb\u7edf\u4f1a\u81ea\u52a8\u6539\u7528\u57fa\u4e8e SCRAM \u7684\u8ba4\u8bc1\u3002</p>\n</dd>\n<dt><span class=\"term\"><code class=\"literal\">password</code></span></dt>\n<dd>\n<p lang=\"zh\">\n<p>\u65b9\u6cd5<code class=\"literal\">password</code>\u4ee5\u660e\u6587\u5f62\u5f0f\u53d1\u9001\u5bc6\u7801\uff0c\u56e0\u6b64\u5b83\u5bb9\u6613\u53d7\u5230\u5bc6\u7801<span class=\"quote\">\u201c<span class=\"quote\">\u55c5\u63a2</span>\u201d</span>\u653b\u51fb\u3002\u5982\u679c\u53ef\u80fd\u5e94\u8be5\u5c3d\u91cf\u907f\u514d\u4f7f\u7528\u5b83\u3002\u4e0d\u8fc7\uff0c\u5982\u679c\u8fde\u63a5\u88abSSL\u52a0\u5bc6\u4fdd\u62a4\u7740\uff0c\u90a3\u4e48\u53ef\u4ee5\u5b89\u5168\u5730\u4f7f\u7528<code class=\"literal\">password</code>\uff08\u4e0d\u8fc7\u5982\u679c\u4f9d\u9760SSL\uff0cSSL\u8bc1\u4e66\u8ba4\u8bc1\u53ef\u80fd\u662f\u66f4\u597d\u7684\u9009\u62e9\uff09\u3002</p>\n</p>\n</dd>\n</dl>\n</div>\n<p lang=\"zh\"><span class=\"productname\">PostgreSQL</span> \u6570\u636e\u5e93\u5bc6\u7801\u72ec\u7acb\u4e8e\u64cd\u4f5c\u7cfb\u7edf\u7528\u6237\u5bc6\u7801\u3002\u6bcf\u4e2a\u6570\u636e\u5e93\u7528\u6237\u7684\u5bc6\u7801\u90fd\u5b58\u50a8\u5728\u7cfb\u7edf\u76ee\u5f55 <code class=\"literal\">pg_authid</code> \u4e2d\u3002\u5bc6\u7801\u53ef\u4ee5\u901a\u8fc7 SQL \u547d\u4ee4<a class=\"xref\" href=\"/docs/11/sql-createrole.html\" title=\"CREATE ROLE\"><span class=\"refentrytitle\">CREATE ROLE</span></a>\u548c<a class=\"xref\" href=\"/docs/11/sql-alterrole.html\" title=\"ALTER ROLE\"><span class=\"refentrytitle\">ALTER ROLE</span></a>\u7ba1\u7406\uff0c\u4f8b\u5982 <strong class=\"userinput\"><code>CREATE ROLE foo WITH LOGIN PASSWORD 'secret'</code></strong>\uff0c\u6216\u8005\u901a\u8fc7 <span class=\"application\">psql</span> \u7684 <code class=\"literal\">\\password</code> \u547d\u4ee4\u7ba1\u7406\u3002\u5982\u679c\u67d0\u4e2a\u7528\u6237\u6ca1\u6709\u8bbe\u7f6e\u5bc6\u7801\uff0c\u5219\u5176\u5b58\u50a8\u5bc6\u7801\u4e3a null\uff0c\u8be5\u7528\u6237\u7684\u5bc6\u7801\u8ba4\u8bc1\u5c06\u59cb\u7ec8\u5931\u8d25\u3002</p>\n<p lang=\"zh\">\u4e0d\u540c\u57fa\u4e8e\u5bc6\u7801\u7684\u8ba4\u8bc1\u65b9\u6cd5\u662f\u5426\u53ef\u7528\uff0c\u53d6\u51b3\u4e8e\u7528\u6237\u5728\u670d\u52a1\u5668\u4e0a\u7684\u5bc6\u7801\u662f\u5982\u4f55\u52a0\u5bc6\u7684\uff08\u66f4\u51c6\u786e\u5730\u8bf4\uff0c\u662f\u5982\u4f55\u8fdb\u884c hash \u8fd0\u7b97\u7684\uff09\u3002\u8fd9\u7531\u8bbe\u7f6e\u5bc6\u7801\u65f6\u7684\u914d\u7f6e\u53c2\u6570<a class=\"xref\" href=\"/docs/11/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION\">password_encryption</a>\u63a7\u5236\u3002\u5982\u679c\u5bc6\u7801\u662f\u4f7f\u7528 <code class=\"literal\">scram-sha-256</code> \u8bbe\u7f6e\u52a0\u5bc6\u7684\uff0c\u90a3\u4e48\u5b83\u53ef\u4ee5\u7528\u4e8e <code class=\"literal\">scram-sha-256</code> \u548c <code class=\"literal\">password</code> \u8ba4\u8bc1\u65b9\u6cd5\uff08\u4f46\u540e\u4e00\u79cd\u60c5\u51b5\u4e0b\u5bc6\u7801\u4f1a\u4ee5\u660e\u6587\u4f20\u8f93\uff09\u3002\u5982\u4e0a\u6240\u8ff0\uff0c\u6b64\u65f6\u5982\u679c\u8ba4\u8bc1\u65b9\u6cd5\u6307\u5b9a\u4e3a <code class=\"literal\">md5</code>\uff0c\u4e5f\u4f1a\u81ea\u52a8\u5207\u6362\u4e3a\u4f7f\u7528 <code class=\"literal\">scram-sha-256</code>\uff0c\u56e0\u6b64\u540c\u6837\u80fd\u591f\u5de5\u4f5c\u3002\u5982\u679c\u5bc6\u7801\u662f\u4f7f\u7528 <code class=\"literal\">md5</code> \u8bbe\u7f6e\u52a0\u5bc6\u7684\uff0c\u90a3\u4e48\u5b83\u53ea\u80fd\u7528\u4e8e <code class=\"literal\">md5</code> \u548c <code class=\"literal\">password</code> \u8ba4\u8bc1\u65b9\u6cd5\uff08\u540c\u6837\uff0c\u540e\u4e00\u79cd\u60c5\u51b5\u4e0b\u5bc6\u7801\u4f1a\u4ee5\u660e\u6587\u4f20\u8f93\uff09\u3002\uff08\u4ee5\u524d\u7684 PostgreSQL \u7248\u672c\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u5b58\u50a8\u660e\u6587\u5bc6\u7801\uff0c\u4f46\u73b0\u5728\u5df2\u7ecf\u4e0d\u518d\u53ef\u80fd\u3002\uff09\u8981\u68c0\u67e5\u5f53\u524d\u5b58\u50a8\u7684\u5bc6\u7801 hash\uff0c\u53ef\u4ee5\u67e5\u770b\u7cfb\u7edf\u76ee\u5f55 <code class=\"literal\">pg_authid</code>\u3002</p>\n<p lang=\"zh\">\u8981\u5c06\u73b0\u6709\u5b89\u88c5\u4ece md5 \u5347\u7ea7\u5230 scram-sha-256\uff0c\u5e94\u5148\u786e\u8ba4\u6240\u6709\u4f7f\u7528\u4e2d\u7684\u5ba2\u6237\u7aef\u5e93\u7248\u672c\u90fd\u652f\u6301 SCRAM\uff1b\u7136\u540e\u5728 postgresql.conf \u4e2d\u8bbe\u7f6e password_encryption = 'scram-sha-256'\uff0c\u8ba9\u6240\u6709\u7528\u6237\u91cd\u65b0\u8bbe\u7f6e\u5bc6\u7801\uff0c\u5e76\u5c06 pg_hba.conf \u4e2d\u7684\u8ba4\u8bc1\u65b9\u6cd5\u6539\u4e3a scram-sha-256\u3002</p>\n</div>", "manual_path": "/docs/11/auth-password.html", "localization": {"status": "complete", "sources": [{"url": "/docs/11/auth-password.html", "method": "same-major semantic node", "sha256": "574e51cfe365412d1caa2c761af5fabfc6066e7dac7d989121284e12ce38d083", "language": "zh", "matched_nodes": ["#AUTH-PASSWORD/div[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]/p[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]/p[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[3]/p[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[3]/p[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[5]", "#AUTH-PASSWORD/p[4]", "#AUTH-PASSWORD/p[6]", "#AUTH-PASSWORD/p[7]"]}], "language": "zh", "original_text": {"/versions/11/description/0": "Require the client to supply an unencrypted password for authentication. Since the password is sent in clear text over the network, this should not be used on untrusted networks. See Section 20.5 for details.", "/versions/11/facts/0/label": "Method", "/versions/11/facts/1/label": "Configuration", "/versions/11/facts/2/label": "Inventory", "/versions/11/facts/2/value": "User-visible source authentication method", "/versions/11/tables/0/title": "Documented method options and alternatives", "/versions/11/tables/0/columns/0/label": "Option or term", "/versions/11/tables/0/columns/1/label": "Meaning", "/versions/11/tables/0/rows/0/description": "The method scram-sha-256 performs SCRAM-SHA-256 authentication, as described in RFC 7677 . It is a challenge-response scheme that prevents password sniffing on untrusted connections and supports storing passwords on the server in a cryptographically hashed form that is thought to be secure. This is the most secure of the currently provided methods, but it is not supported by older client libraries.", "/versions/11/tables/0/rows/1/description": "The method md5 uses a custom less secure challenge-response mechanism. It prevents password sniffing and avoids storing passwords on the server in plain text but provides no protection if an attacker manages to steal the password hash from the server. Also, the MD5 hash algorithm is nowadays no longer considered secure against determined attacks. The md5 method cannot be used with the db_user_namespace feature. To ease transition from the md5 method to the newer SCRAM method, if md5 is specified as a method in pg_hba.conf but the user's password on the server is encrypted for SCRAM (see below), then SCRAM-based authentication will automatically be chosen instead.", "/versions/11/tables/0/rows/2/description": "The method password sends the password in clear-text and is therefore vulnerable to password \u201c sniffing \u201d attacks. It should always be avoided if possible. If the connection is protected by SSL encryption then password can be used safely, though. (Though SSL certificate authentication might be a better choice if one is depending on using SSL)."}, "fallback_fields": [], "source_language": "en", "original_snapshot_sha256": "060e73ce73b1ab74ab807b4973fd3ae6dd462946aa4f863064671888848ad692"}, "comparison_data": {"method": "password", "documented_option_names": ["md5", "password", "scram-sha-256"]}, "comparison_hash": "d4a07ed4f297699ecd061181bcc656e57ea443c94b1d7536a172c08865099daf", "manual_language": "zh"}, "12": {"facts": [{"label": "\u65b9\u6cd5", "value": "password"}, {"label": "\u914d\u7f6e", "value": "pg_hba.conf"}, {"label": "\u6e05\u5355", "value": "\u7528\u6237\u53ef\u89c1\u7684\u6e90\u7801\u8ba4\u8bc1\u65b9\u6cd5"}], "tables": [{"key": "method-options", "rows": [{"name": "scram-sha-256", "description": "scram-sha-256 \u65b9\u6cd5\u6267\u884c SCRAM-SHA-256 \u8ba4\u8bc1\uff0c\u5176\u5b9a\u4e49\u89c1 RFC 7677 \u3002\u5b83\u662f\u4e00\u79cd\u6311\u6218-\u54cd\u5e94\u65b9\u6848\uff0c\u53ef\u9632\u6b62\u5728\u4e0d\u53d7\u4fe1\u4efb\u8fde\u63a5\u4e0a\u55c5\u63a2\u5bc6\u7801\uff0c\u5e76\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u88ab\u8ba4\u4e3a\u5b89\u5168\u7684\u5bc6\u7801\u5b66 hash \u5f62\u5f0f\u5b58\u50a8\u5bc6\u7801\u3002 \u8fd9\u662f\u5f53\u524d\u63d0\u4f9b\u7684\u65b9\u6cd5\u4e2d\u6700\u5b89\u5168\u7684\u4e00\u79cd\uff0c\u4f46\u662f\u65e7\u7684\u5ba2\u6237\u7aef\u5e93\u4e0d\u652f\u6301\u8fd9\u79cd\u65b9\u6cd5\u3002"}, {"name": "md5", "description": "md5 \u65b9\u6cd5\u4f7f\u7528\u81ea\u5b9a\u4e49\u4e14\u5b89\u5168\u6027\u8f83\u5f31\u7684\u6311\u6218\u54cd\u5e94\u673a\u5236\u3002\u5b83\u80fd\u9632\u6b62\u5bc6\u7801\u55c5\u63a2\uff0c\u907f\u514d\u670d\u52a1\u5668\u660e\u6587\u5b58\u50a8\u5bc6\u7801\uff1b\u4f46\u653b\u51fb\u8005\u4e00\u65e6\u7a83\u53d6\u670d\u52a1\u5668\u4e0a\u7684\u5bc6\u7801\u54c8\u5e0c\uff0c\u5c31\u65e0\u6cd5\u63d0\u4f9b\u4fdd\u62a4\u3002\u6b64\u5916\uff0cMD5 \u54c8\u5e0c\u7b97\u6cd5\u5982\u4eca\u5df2\u4e0d\u518d\u88ab\u8ba4\u4e3a\u80fd\u5b89\u5168\u62b5\u5fa1\u6709\u9488\u5bf9\u6027\u7684\u653b\u51fb\u3002md5 \u65b9\u6cd5\u4e0d\u80fd\u4e0e db_user_namespace \u529f\u80fd\u4e00\u8d77\u4f7f\u7528\u3002\u4e3a\u4fbf\u4e8e\u4ece md5 \u8fc1\u79fb\u5230\u8f83\u65b0\u7684 SCRAM \u65b9\u6cd5\uff0c\u5982\u679c pg_hba.conf \u4e2d\u6307\u5b9a md5\uff0c\u4f46\u670d\u52a1\u5668\u4e0a\u8be5\u7528\u6237\u7684\u5bc6\u7801\u91c7\u7528 SCRAM \u52a0\u5bc6\u5b58\u50a8\uff08\u89c1\u4e0b\u6587\uff09\uff0c\u7cfb\u7edf\u4f1a\u81ea\u52a8\u6539\u7528\u57fa\u4e8e SCRAM \u7684\u8ba4\u8bc1\u3002"}, {"name": "password", "description": "\u65b9\u6cd5 password \u4ee5\u660e\u6587\u5f62\u5f0f\u53d1\u9001\u5bc6\u7801\uff0c\u56e0\u6b64\u5b83\u5bb9\u6613\u53d7\u5230\u5bc6\u7801 \u201c \u55c5\u63a2 \u201d \u653b\u51fb\u3002\u5982\u679c\u53ef\u80fd\u5e94\u8be5\u5c3d\u91cf\u907f\u514d\u4f7f\u7528\u5b83\u3002\u4e0d\u8fc7\uff0c\u5982\u679c\u8fde\u63a5\u88abSSL\u52a0\u5bc6\u4fdd\u62a4\u7740\uff0c\u90a3\u4e48\u53ef\u4ee5\u5b89\u5168\u5730\u4f7f\u7528 password \uff08\u4e0d\u8fc7\u5982\u679c\u4f9d\u9760SSL\uff0cSSL\u8bc1\u4e66\u8ba4\u8bc1\u53ef\u80fd\u662f\u66f4\u597d\u7684\u9009\u62e9\uff09\u3002"}], "title": "\u624b\u518c\u4e2d\u7684\u65b9\u6cd5\u9009\u9879\u4e0e\u66ff\u4ee3\u65b9\u5f0f", "columns": [{"key": "name", "label": "\u9009\u9879\u6216\u672f\u8bed"}, {"key": "description", "label": "\u542b\u4e49"}]}], "aliases": [], "related": [], "release": {"ref": "https://ftp.postgresql.org/pub/source/v12.22/postgresql-12.22.tar.bz2", "label": "12.22", "major": "12", "channel": "historical", "revision": "8df3c0474782589d3c6f374b5133b1bd14d168086edbc13c6e72e67dd4527a3b", "source_sha256": "8df3c0474782589d3c6f374b5133b1bd14d168086edbc13c6e72e67dd4527a3b", "catalog_fingerprint": "9f857f4ee4875f9c7de6bfc9df4b757dec8b3a0bb88eadb519c7bd267bd56149"}, "sources": [{"url": "https://ftp.postgresql.org/pub/source/v12.22/postgresql-12.22.tar.bz2", "label": "Matching PostgreSQL source archive", "sha256": "8df3c0474782589d3c6f374b5133b1bd14d168086edbc13c6e72e67dd4527a3b"}, {"url": "https://pg.center/docs/12/auth-password.html", "path": "auth-password.html", "label": "PostgreSQL 12 English manual", "sha256": "e1fba06a81ce077a266c8852e9090a4a1521207479d17e24a55068099fb9eb65", "language": "en", "original_url": "/docs/12/auth-password.html"}, {"url": "https://pg.center/docs/12/auth-pg-hba-conf.html", "path": "auth-pg-hba-conf.html", "label": "PostgreSQL 12 English manual", "sha256": "07e8cddcb38076c86dab95b72c4380a7a325f22401b5b7f9af5dd4931876f2cb", "language": "en", "original_url": "/docs/12/auth-pg-hba-conf.html"}], "sections": [], "signature": "", "attributes": {"method": "password", "inventory": "User-visible source authentication method", "configuration": "pg_hba.conf"}, "description": ["\u8981\u6c42\u5ba2\u6237\u7aef\u63d0\u4f9b\u672a\u7ecf\u52a0\u5bc6\u7684\u5bc6\u7801\u8fdb\u884c\u8ba4\u8bc1\u3002\u7531\u4e8e\u5bc6\u7801\u901a\u8fc7\u7f51\u7edc\u660e\u6587\u4f20\u8f93\uff0c\u4e0d\u5e94\u5728\u4e0d\u53ef\u4fe1\u7f51\u7edc\u4e0a\u4f7f\u7528\u3002\u8be6\u60c5\u53c2\u89c1\u7b2c 20.5 \u8282\u3002"], "manual_html": "<div class=\"sect1\" id=\"AUTH-PASSWORD\">\n<div class=\"titlepage\">\n<div>\n<div>\n<h2 class=\"title\" lang=\"zh\">\n<div>\n<div>\n<h2 class=\"title\" style=\"clear: both\">20.5.\u00a0\u5bc6\u7801\u8ba4\u8bc1 </h2>\n</div>\n</div>\n</h2>\n</div>\n</div>\n</div>\n<p lang=\"zh\">\u6709\u51e0\u79cd\u57fa\u4e8e\u5bc6\u7801\u7684\u8ba4\u8bc1\u65b9\u6cd5\u3002\u8fd9\u4e9b\u65b9\u6cd5\u7684\u8fc7\u7a0b\u7c7b\u4f3c\uff0c\u4f46\u662f\u533a\u522b\u5728\u4e8e\u7528\u6237\u5bc6\u7801\u5982\u4f55\u88ab\u5b58\u653e\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u53ca\u5ba2\u6237\u7aef\u63d0\u4f9b\u7684\u5bc6\u7801\u5982\u4f55\u88ab\u901a\u8fc7\u8fde\u63a5\u53d1\u9001\u3002</p>\n<div class=\"variablelist\">\n<dl class=\"variablelist\">\n<dt><span class=\"term\"><code class=\"literal\">scram-sha-256</code></span></dt>\n<dd>\n<p lang=\"zh\"><code class=\"literal\">scram-sha-256</code> \u65b9\u6cd5\u6267\u884c SCRAM-SHA-256 \u8ba4\u8bc1\uff0c\u5176\u5b9a\u4e49\u89c1 <a class=\"ulink\" href=\"https://datatracker.ietf.org/doc/html/rfc7677\" target=\"_top\">RFC 7677</a>\u3002\u5b83\u662f\u4e00\u79cd\u6311\u6218-\u54cd\u5e94\u65b9\u6848\uff0c\u53ef\u9632\u6b62\u5728\u4e0d\u53d7\u4fe1\u4efb\u8fde\u63a5\u4e0a\u55c5\u63a2\u5bc6\u7801\uff0c\u5e76\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u88ab\u8ba4\u4e3a\u5b89\u5168\u7684\u5bc6\u7801\u5b66 hash \u5f62\u5f0f\u5b58\u50a8\u5bc6\u7801\u3002</p>\n<p lang=\"zh\">\u8fd9\u662f\u5f53\u524d\u63d0\u4f9b\u7684\u65b9\u6cd5\u4e2d\u6700\u5b89\u5168\u7684\u4e00\u79cd\uff0c\u4f46\u662f\u65e7\u7684\u5ba2\u6237\u7aef\u5e93\u4e0d\u652f\u6301\u8fd9\u79cd\u65b9\u6cd5\u3002</p>\n</dd>\n<dt><span class=\"term\"><code class=\"literal\">md5</code></span></dt>\n<dd>\n<p lang=\"zh\">\u65b9\u6cd5<code class=\"literal\">md5</code>\u4f7f\u7528\u4e00\u79cd\u81ea\u5b9a\u4e49\u7684\u3001\u5b89\u5168\u6027\u8f83\u4f4e\u7684\u6311\u6218-\u54cd\u5e94\u673a\u5236\u3002\u5b83\u80fd\u9632\u6b62\u5bc6\u7801\u55c5\u63a2\uff0c\u5e76\u907f\u514d\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u660e\u6587\u5b58\u50a8\u5bc6\u7801\uff1b\u4f46\u5982\u679c\u653b\u51fb\u8005\u8bbe\u6cd5\u4ece\u670d\u52a1\u5668\u4e0a\u7a83\u53d6\u4e86\u5bc6\u7801 hash\uff0c\u5b83\u5c31\u65e0\u6cd5\u63d0\u4f9b\u4fdd\u62a4\u3002\u6b64\u5916\uff0c\u5982\u4eca\u5df2\u4e0d\u518d\u8ba4\u4e3a MD5 hash \u7b97\u6cd5\u80fd\u62b5\u5fa1\u6709\u51b3\u5fc3\u7684\u653b\u51fb\u8005\u3002</p>\n<p lang=\"zh\"><code class=\"literal\">md5</code>\u65b9\u6cd5\u4e0d\u80fd\u4e0e<a class=\"xref\" href=\"/docs/12/runtime-config-connection.html#GUC-DB-USER-NAMESPACE\">db_user_namespace</a>\u529f\u80fd\u4e00\u8d77\u4f7f\u7528\u3002</p>\n<p lang=\"zh\">\u4e3a\u4fbf\u4e8e\u4ece md5 \u8fc1\u79fb\u5230\u8f83\u65b0\u7684 SCRAM \u65b9\u6cd5\uff0c\u5982\u679c pg_hba.conf \u4e2d\u6307\u5b9a md5\uff0c\u4f46\u670d\u52a1\u5668\u4e0a\u8be5\u7528\u6237\u7684\u5bc6\u7801\u91c7\u7528 SCRAM \u52a0\u5bc6\u5b58\u50a8\uff08\u89c1\u4e0b\u6587\uff09\uff0c\u7cfb\u7edf\u4f1a\u81ea\u52a8\u6539\u7528\u57fa\u4e8e SCRAM \u7684\u8ba4\u8bc1\u3002</p>\n</dd>\n<dt><span class=\"term\"><code class=\"literal\">password</code></span></dt>\n<dd>\n<p lang=\"zh\">\n<p>\u65b9\u6cd5<code class=\"literal\">password</code>\u4ee5\u660e\u6587\u5f62\u5f0f\u53d1\u9001\u5bc6\u7801\uff0c\u56e0\u6b64\u5b83\u5bb9\u6613\u53d7\u5230\u5bc6\u7801<span class=\"quote\">\u201c<span class=\"quote\">\u55c5\u63a2</span>\u201d</span>\u653b\u51fb\u3002\u5982\u679c\u53ef\u80fd\u5e94\u8be5\u5c3d\u91cf\u907f\u514d\u4f7f\u7528\u5b83\u3002\u4e0d\u8fc7\uff0c\u5982\u679c\u8fde\u63a5\u88abSSL\u52a0\u5bc6\u4fdd\u62a4\u7740\uff0c\u90a3\u4e48\u53ef\u4ee5\u5b89\u5168\u5730\u4f7f\u7528<code class=\"literal\">password</code>\uff08\u4e0d\u8fc7\u5982\u679c\u4f9d\u9760SSL\uff0cSSL\u8bc1\u4e66\u8ba4\u8bc1\u53ef\u80fd\u662f\u66f4\u597d\u7684\u9009\u62e9\uff09\u3002</p>\n</p>\n</dd>\n</dl>\n</div>\n<p lang=\"zh\"><span class=\"productname\">PostgreSQL</span> \u6570\u636e\u5e93\u5bc6\u7801\u72ec\u7acb\u4e8e\u64cd\u4f5c\u7cfb\u7edf\u7528\u6237\u5bc6\u7801\u3002\u6bcf\u4e2a\u6570\u636e\u5e93\u7528\u6237\u7684\u5bc6\u7801\u90fd\u5b58\u50a8\u5728\u7cfb\u7edf\u76ee\u5f55 <code class=\"literal\">pg_authid</code> \u4e2d\u3002\u5bc6\u7801\u53ef\u4ee5\u901a\u8fc7 SQL \u547d\u4ee4<a class=\"xref\" href=\"/docs/12/sql-createrole.html\" title=\"CREATE ROLE\"><span class=\"refentrytitle\">CREATE ROLE</span></a>\u548c<a class=\"xref\" href=\"/docs/12/sql-alterrole.html\" title=\"ALTER ROLE\"><span class=\"refentrytitle\">ALTER ROLE</span></a>\u7ba1\u7406\uff0c\u4f8b\u5982 <strong class=\"userinput\"><code>CREATE ROLE foo WITH LOGIN PASSWORD 'secret'</code></strong>\uff0c\u6216\u8005\u901a\u8fc7 <span class=\"application\">psql</span> \u7684 <code class=\"literal\">\\password</code> \u547d\u4ee4\u7ba1\u7406\u3002\u5982\u679c\u67d0\u4e2a\u7528\u6237\u6ca1\u6709\u8bbe\u7f6e\u5bc6\u7801\uff0c\u5219\u5176\u5b58\u50a8\u5bc6\u7801\u4e3a null\uff0c\u8be5\u7528\u6237\u7684\u5bc6\u7801\u8ba4\u8bc1\u5c06\u59cb\u7ec8\u5931\u8d25\u3002</p>\n<p lang=\"zh\">\u4e0d\u540c\u57fa\u4e8e\u5bc6\u7801\u7684\u8ba4\u8bc1\u65b9\u6cd5\u662f\u5426\u53ef\u7528\uff0c\u53d6\u51b3\u4e8e\u7528\u6237\u5728\u670d\u52a1\u5668\u4e0a\u7684\u5bc6\u7801\u662f\u5982\u4f55\u52a0\u5bc6\u7684\uff08\u66f4\u51c6\u786e\u5730\u8bf4\uff0c\u662f\u5982\u4f55\u8fdb\u884c hash \u8fd0\u7b97\u7684\uff09\u3002\u8fd9\u7531\u8bbe\u7f6e\u5bc6\u7801\u65f6\u7684\u914d\u7f6e\u53c2\u6570<a class=\"xref\" href=\"/docs/12/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION\">password_encryption</a>\u63a7\u5236\u3002\u5982\u679c\u5bc6\u7801\u662f\u4f7f\u7528 <code class=\"literal\">scram-sha-256</code> \u8bbe\u7f6e\u52a0\u5bc6\u7684\uff0c\u90a3\u4e48\u5b83\u53ef\u4ee5\u7528\u4e8e <code class=\"literal\">scram-sha-256</code> \u548c <code class=\"literal\">password</code> \u8ba4\u8bc1\u65b9\u6cd5\uff08\u4f46\u540e\u4e00\u79cd\u60c5\u51b5\u4e0b\u5bc6\u7801\u4f1a\u4ee5\u660e\u6587\u4f20\u8f93\uff09\u3002\u5982\u4e0a\u6240\u8ff0\uff0c\u6b64\u65f6\u5982\u679c\u8ba4\u8bc1\u65b9\u6cd5\u6307\u5b9a\u4e3a <code class=\"literal\">md5</code>\uff0c\u4e5f\u4f1a\u81ea\u52a8\u5207\u6362\u4e3a\u4f7f\u7528 <code class=\"literal\">scram-sha-256</code>\uff0c\u56e0\u6b64\u540c\u6837\u80fd\u591f\u5de5\u4f5c\u3002\u5982\u679c\u5bc6\u7801\u662f\u4f7f\u7528 <code class=\"literal\">md5</code> \u8bbe\u7f6e\u52a0\u5bc6\u7684\uff0c\u90a3\u4e48\u5b83\u53ea\u80fd\u7528\u4e8e <code class=\"literal\">md5</code> \u548c <code class=\"literal\">password</code> \u8ba4\u8bc1\u65b9\u6cd5\uff08\u540c\u6837\uff0c\u540e\u4e00\u79cd\u60c5\u51b5\u4e0b\u5bc6\u7801\u4f1a\u4ee5\u660e\u6587\u4f20\u8f93\uff09\u3002\uff08\u4ee5\u524d\u7684 PostgreSQL \u7248\u672c\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u5b58\u50a8\u660e\u6587\u5bc6\u7801\uff0c\u4f46\u73b0\u5728\u5df2\u7ecf\u4e0d\u518d\u53ef\u80fd\u3002\uff09\u8981\u68c0\u67e5\u5f53\u524d\u5b58\u50a8\u7684\u5bc6\u7801 hash\uff0c\u53ef\u4ee5\u67e5\u770b\u7cfb\u7edf\u76ee\u5f55 <code class=\"literal\">pg_authid</code>\u3002</p>\n<p lang=\"zh\">\u8981\u5c06\u73b0\u6709\u5b89\u88c5\u4ece md5 \u5347\u7ea7\u5230 scram-sha-256\uff0c\u5e94\u5148\u786e\u8ba4\u6240\u6709\u4f7f\u7528\u4e2d\u7684\u5ba2\u6237\u7aef\u5e93\u7248\u672c\u90fd\u652f\u6301 SCRAM\uff1b\u7136\u540e\u5728 postgresql.conf \u4e2d\u8bbe\u7f6e password_encryption = 'scram-sha-256'\uff0c\u8ba9\u6240\u6709\u7528\u6237\u91cd\u65b0\u8bbe\u7f6e\u5bc6\u7801\uff0c\u5e76\u5c06 pg_hba.conf \u4e2d\u7684\u8ba4\u8bc1\u65b9\u6cd5\u6539\u4e3a scram-sha-256\u3002</p>\n</div>", "manual_path": "/docs/12/auth-password.html", "localization": {"status": "complete", "sources": [{"url": "/docs/12/auth-password.html", "method": "same-major semantic node", "sha256": "70ec6bb6764528c28a8a1e45b9d394b8bafbef9740d5c2ac182076656c789771", "language": "zh", "matched_nodes": ["#AUTH-PASSWORD/div[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]/p[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]/p[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[3]/p[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[3]/p[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[5]", "#AUTH-PASSWORD/p[4]", "#AUTH-PASSWORD/p[6]", "#AUTH-PASSWORD/p[7]"]}], "language": "zh", "original_text": {"/versions/12/description/0": "Require the client to supply an unencrypted password for authentication. Since the password is sent in clear text over the network, this should not be used on untrusted networks. See Section 20.5 for details.", "/versions/12/facts/0/label": "Method", "/versions/12/facts/1/label": "Configuration", "/versions/12/facts/2/label": "Inventory", "/versions/12/facts/2/value": "User-visible source authentication method", "/versions/12/tables/0/title": "Documented method options and alternatives", "/versions/12/tables/0/columns/0/label": "Option or term", "/versions/12/tables/0/columns/1/label": "Meaning", "/versions/12/tables/0/rows/0/description": "The method scram-sha-256 performs SCRAM-SHA-256 authentication, as described in RFC 7677 . It is a challenge-response scheme that prevents password sniffing on untrusted connections and supports storing passwords on the server in a cryptographically hashed form that is thought to be secure. This is the most secure of the currently provided methods, but it is not supported by older client libraries.", "/versions/12/tables/0/rows/1/description": "The method md5 uses a custom less secure challenge-response mechanism. It prevents password sniffing and avoids storing passwords on the server in plain text but provides no protection if an attacker manages to steal the password hash from the server. Also, the MD5 hash algorithm is nowadays no longer considered secure against determined attacks. The md5 method cannot be used with the db_user_namespace feature. To ease transition from the md5 method to the newer SCRAM method, if md5 is specified as a method in pg_hba.conf but the user's password on the server is encrypted for SCRAM (see below), then SCRAM-based authentication will automatically be chosen instead.", "/versions/12/tables/0/rows/2/description": "The method password sends the password in clear-text and is therefore vulnerable to password \u201c sniffing \u201d attacks. It should always be avoided if possible. If the connection is protected by SSL encryption then password can be used safely, though. (Though SSL certificate authentication might be a better choice if one is depending on using SSL)."}, "fallback_fields": [], "source_language": "en", "original_snapshot_sha256": "fa1e93dccbcafae63a8780f7bfd4b26b5d847f48393bac5676216f8743a7d247"}, "comparison_data": {"method": "password", "documented_option_names": ["md5", "password", "scram-sha-256"]}, "comparison_hash": "d4a07ed4f297699ecd061181bcc656e57ea443c94b1d7536a172c08865099daf", "manual_language": "zh"}, "13": {"facts": [{"label": "\u65b9\u6cd5", "value": "password"}, {"label": "\u914d\u7f6e", "value": "pg_hba.conf"}, {"label": "\u6e05\u5355", "value": "\u7528\u6237\u53ef\u89c1\u7684\u6e90\u7801\u8ba4\u8bc1\u65b9\u6cd5"}], "tables": [{"key": "method-options", "rows": [{"name": "scram-sha-256", "description": "scram-sha-256 \u65b9\u6cd5\u6267\u884c SCRAM-SHA-256 \u8ba4\u8bc1\uff0c\u5176\u5b9a\u4e49\u89c1 RFC 7677 \u3002\u5b83\u662f\u4e00\u79cd\u6311\u6218-\u54cd\u5e94\u65b9\u6848\uff0c\u53ef\u9632\u6b62\u5728\u4e0d\u53d7\u4fe1\u4efb\u8fde\u63a5\u4e0a\u55c5\u63a2\u5bc6\u7801\uff0c\u5e76\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u88ab\u8ba4\u4e3a\u5b89\u5168\u7684\u5bc6\u7801\u5b66 hash \u5f62\u5f0f\u5b58\u50a8\u5bc6\u7801\u3002 \u8fd9\u662f\u5f53\u524d\u63d0\u4f9b\u7684\u65b9\u6cd5\u4e2d\u6700\u5b89\u5168\u7684\u4e00\u79cd\uff0c\u4f46\u662f\u65e7\u7684\u5ba2\u6237\u7aef\u5e93\u4e0d\u652f\u6301\u8fd9\u79cd\u65b9\u6cd5\u3002"}, {"name": "md5", "description": "md5 \u65b9\u6cd5\u4f7f\u7528\u81ea\u5b9a\u4e49\u4e14\u5b89\u5168\u6027\u8f83\u5f31\u7684\u6311\u6218\u54cd\u5e94\u673a\u5236\u3002\u5b83\u80fd\u9632\u6b62\u5bc6\u7801\u55c5\u63a2\uff0c\u907f\u514d\u670d\u52a1\u5668\u660e\u6587\u5b58\u50a8\u5bc6\u7801\uff1b\u4f46\u653b\u51fb\u8005\u4e00\u65e6\u7a83\u53d6\u670d\u52a1\u5668\u4e0a\u7684\u5bc6\u7801\u54c8\u5e0c\uff0c\u5c31\u65e0\u6cd5\u63d0\u4f9b\u4fdd\u62a4\u3002\u6b64\u5916\uff0cMD5 \u54c8\u5e0c\u7b97\u6cd5\u5982\u4eca\u5df2\u4e0d\u518d\u88ab\u8ba4\u4e3a\u80fd\u5b89\u5168\u62b5\u5fa1\u6709\u9488\u5bf9\u6027\u7684\u653b\u51fb\u3002md5 \u65b9\u6cd5\u4e0d\u80fd\u4e0e db_user_namespace \u529f\u80fd\u4e00\u8d77\u4f7f\u7528\u3002\u4e3a\u4fbf\u4e8e\u4ece md5 \u8fc1\u79fb\u5230\u8f83\u65b0\u7684 SCRAM \u65b9\u6cd5\uff0c\u5982\u679c pg_hba.conf \u4e2d\u6307\u5b9a md5\uff0c\u4f46\u670d\u52a1\u5668\u4e0a\u8be5\u7528\u6237\u7684\u5bc6\u7801\u91c7\u7528 SCRAM \u52a0\u5bc6\u5b58\u50a8\uff08\u89c1\u4e0b\u6587\uff09\uff0c\u7cfb\u7edf\u4f1a\u81ea\u52a8\u6539\u7528\u57fa\u4e8e SCRAM \u7684\u8ba4\u8bc1\u3002"}, {"name": "password", "description": "\u65b9\u6cd5 password \u4ee5\u660e\u6587\u5f62\u5f0f\u53d1\u9001\u5bc6\u7801\uff0c\u56e0\u6b64\u5b83\u5bb9\u6613\u53d7\u5230\u5bc6\u7801 \u201c \u55c5\u63a2 \u201d \u653b\u51fb\u3002\u5982\u679c\u53ef\u80fd\u5e94\u8be5\u5c3d\u91cf\u907f\u514d\u4f7f\u7528\u5b83\u3002\u4e0d\u8fc7\uff0c\u5982\u679c\u8fde\u63a5\u88abSSL\u52a0\u5bc6\u4fdd\u62a4\u7740\uff0c\u90a3\u4e48\u53ef\u4ee5\u5b89\u5168\u5730\u4f7f\u7528 password \uff08\u4e0d\u8fc7\u5982\u679c\u4f9d\u9760SSL\uff0cSSL\u8bc1\u4e66\u8ba4\u8bc1\u53ef\u80fd\u662f\u66f4\u597d\u7684\u9009\u62e9\uff09\u3002"}], "title": "\u624b\u518c\u4e2d\u7684\u65b9\u6cd5\u9009\u9879\u4e0e\u66ff\u4ee3\u65b9\u5f0f", "columns": [{"key": "name", "label": "\u9009\u9879\u6216\u672f\u8bed"}, {"key": "description", "label": "\u542b\u4e49"}]}], "aliases": [], "related": [], "release": {"ref": "https://ftp.postgresql.org/pub/source/v13.23/postgresql-13.23.tar.bz2", "label": "13.23", "major": "13", "channel": "historical", "revision": "6ec3c82726af92b7dec873fa1cdf881eca92a4219787dfad05acb6b10e041fd6", "source_sha256": "6ec3c82726af92b7dec873fa1cdf881eca92a4219787dfad05acb6b10e041fd6", "catalog_fingerprint": "c7015c845255c9d721c547c8ab9ef37825d332588c9691d982e6906b7d571002"}, "sources": [{"url": "https://ftp.postgresql.org/pub/source/v13.23/postgresql-13.23.tar.bz2", "label": "Matching PostgreSQL source archive", "sha256": "6ec3c82726af92b7dec873fa1cdf881eca92a4219787dfad05acb6b10e041fd6"}, {"url": "https://pg.center/docs/13/auth-password.html", "path": "auth-password.html", "label": "PostgreSQL 13 English manual", "sha256": "7dc40d4c26e2dbb20902a9b975ba37437baf8433804400191badd8487fe0eab6", "language": "en", "original_url": "/docs/13/auth-password.html"}, {"url": "https://pg.center/docs/13/auth-pg-hba-conf.html", "path": "auth-pg-hba-conf.html", "label": "PostgreSQL 13 English manual", "sha256": "3cc6ce851945cba450e6b26ecf9cae1efd3c03fb7b55e17876f4d9ea418a7c2e", "language": "en", "original_url": "/docs/13/auth-pg-hba-conf.html"}], "sections": [], "signature": "", "attributes": {"method": "password", "inventory": "User-visible source authentication method", "configuration": "pg_hba.conf"}, "description": ["\u8981\u6c42\u5ba2\u6237\u7aef\u63d0\u4f9b\u672a\u7ecf\u52a0\u5bc6\u7684\u5bc6\u7801\u8fdb\u884c\u8ba4\u8bc1\u3002\u7531\u4e8e\u5bc6\u7801\u901a\u8fc7\u7f51\u7edc\u660e\u6587\u4f20\u8f93\uff0c\u4e0d\u5e94\u5728\u4e0d\u53ef\u4fe1\u7f51\u7edc\u4e0a\u4f7f\u7528\u3002\u8be6\u60c5\u53c2\u89c1\u7b2c 20.5 \u8282\u3002"], "manual_html": "<div class=\"sect1\" id=\"AUTH-PASSWORD\">\n<div class=\"titlepage\">\n<div>\n<div>\n<h2 class=\"title\" lang=\"zh\">\n<div>\n<div>\n<h2 class=\"title\" style=\"clear: both\">20.5.\u00a0\u5bc6\u7801\u8ba4\u8bc1 </h2>\n</div>\n</div>\n</h2>\n</div>\n</div>\n</div>\n<p lang=\"zh\">\u6709\u51e0\u79cd\u57fa\u4e8e\u5bc6\u7801\u7684\u8ba4\u8bc1\u65b9\u6cd5\u3002\u8fd9\u4e9b\u65b9\u6cd5\u7684\u8fc7\u7a0b\u7c7b\u4f3c\uff0c\u4f46\u662f\u533a\u522b\u5728\u4e8e\u7528\u6237\u5bc6\u7801\u5982\u4f55\u88ab\u5b58\u653e\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u53ca\u5ba2\u6237\u7aef\u63d0\u4f9b\u7684\u5bc6\u7801\u5982\u4f55\u88ab\u901a\u8fc7\u8fde\u63a5\u53d1\u9001\u3002</p>\n<div class=\"variablelist\">\n<dl class=\"variablelist\">\n<dt><span class=\"term\"><code class=\"literal\">scram-sha-256</code></span></dt>\n<dd>\n<p lang=\"zh\"><code class=\"literal\">scram-sha-256</code> \u65b9\u6cd5\u6267\u884c SCRAM-SHA-256 \u8ba4\u8bc1\uff0c\u5176\u5b9a\u4e49\u89c1 <a class=\"ulink\" href=\"https://datatracker.ietf.org/doc/html/rfc7677\" target=\"_top\">RFC 7677</a>\u3002\u5b83\u662f\u4e00\u79cd\u6311\u6218-\u54cd\u5e94\u65b9\u6848\uff0c\u53ef\u9632\u6b62\u5728\u4e0d\u53d7\u4fe1\u4efb\u8fde\u63a5\u4e0a\u55c5\u63a2\u5bc6\u7801\uff0c\u5e76\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u88ab\u8ba4\u4e3a\u5b89\u5168\u7684\u5bc6\u7801\u5b66 hash \u5f62\u5f0f\u5b58\u50a8\u5bc6\u7801\u3002</p>\n<p lang=\"zh\">\u8fd9\u662f\u5f53\u524d\u63d0\u4f9b\u7684\u65b9\u6cd5\u4e2d\u6700\u5b89\u5168\u7684\u4e00\u79cd\uff0c\u4f46\u662f\u65e7\u7684\u5ba2\u6237\u7aef\u5e93\u4e0d\u652f\u6301\u8fd9\u79cd\u65b9\u6cd5\u3002</p>\n</dd>\n<dt><span class=\"term\"><code class=\"literal\">md5</code></span></dt>\n<dd>\n<p lang=\"zh\">\u65b9\u6cd5<code class=\"literal\">md5</code>\u4f7f\u7528\u4e00\u79cd\u81ea\u5b9a\u4e49\u7684\u3001\u5b89\u5168\u6027\u8f83\u4f4e\u7684\u6311\u6218-\u54cd\u5e94\u673a\u5236\u3002\u5b83\u80fd\u9632\u6b62\u5bc6\u7801\u55c5\u63a2\uff0c\u5e76\u907f\u514d\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u660e\u6587\u5b58\u50a8\u5bc6\u7801\uff1b\u4f46\u5982\u679c\u653b\u51fb\u8005\u8bbe\u6cd5\u4ece\u670d\u52a1\u5668\u4e0a\u7a83\u53d6\u4e86\u5bc6\u7801 hash\uff0c\u5b83\u5c31\u65e0\u6cd5\u63d0\u4f9b\u4fdd\u62a4\u3002\u6b64\u5916\uff0c\u5982\u4eca\u5df2\u4e0d\u518d\u8ba4\u4e3a MD5 hash \u7b97\u6cd5\u80fd\u62b5\u5fa1\u6709\u51b3\u5fc3\u7684\u653b\u51fb\u8005\u3002</p>\n<p lang=\"zh\"><code class=\"literal\">md5</code>\u65b9\u6cd5\u4e0d\u80fd\u4e0e<a class=\"xref\" href=\"/docs/13/runtime-config-connection.html#GUC-DB-USER-NAMESPACE\">db_user_namespace</a>\u529f\u80fd\u4e00\u8d77\u4f7f\u7528\u3002</p>\n<p lang=\"zh\">\u4e3a\u4fbf\u4e8e\u4ece md5 \u8fc1\u79fb\u5230\u8f83\u65b0\u7684 SCRAM \u65b9\u6cd5\uff0c\u5982\u679c pg_hba.conf \u4e2d\u6307\u5b9a md5\uff0c\u4f46\u670d\u52a1\u5668\u4e0a\u8be5\u7528\u6237\u7684\u5bc6\u7801\u91c7\u7528 SCRAM \u52a0\u5bc6\u5b58\u50a8\uff08\u89c1\u4e0b\u6587\uff09\uff0c\u7cfb\u7edf\u4f1a\u81ea\u52a8\u6539\u7528\u57fa\u4e8e SCRAM \u7684\u8ba4\u8bc1\u3002</p>\n</dd>\n<dt><span class=\"term\"><code class=\"literal\">password</code></span></dt>\n<dd>\n<p lang=\"zh\">\n<p>\u65b9\u6cd5<code class=\"literal\">password</code>\u4ee5\u660e\u6587\u5f62\u5f0f\u53d1\u9001\u5bc6\u7801\uff0c\u56e0\u6b64\u5b83\u5bb9\u6613\u53d7\u5230\u5bc6\u7801<span class=\"quote\">\u201c<span class=\"quote\">\u55c5\u63a2</span>\u201d</span>\u653b\u51fb\u3002\u5982\u679c\u53ef\u80fd\u5e94\u8be5\u5c3d\u91cf\u907f\u514d\u4f7f\u7528\u5b83\u3002\u4e0d\u8fc7\uff0c\u5982\u679c\u8fde\u63a5\u88abSSL\u52a0\u5bc6\u4fdd\u62a4\u7740\uff0c\u90a3\u4e48\u53ef\u4ee5\u5b89\u5168\u5730\u4f7f\u7528<code class=\"literal\">password</code>\uff08\u4e0d\u8fc7\u5982\u679c\u4f9d\u9760SSL\uff0cSSL\u8bc1\u4e66\u8ba4\u8bc1\u53ef\u80fd\u662f\u66f4\u597d\u7684\u9009\u62e9\uff09\u3002</p>\n</p>\n</dd>\n</dl>\n</div>\n<p lang=\"zh\"><span class=\"productname\">PostgreSQL</span> \u6570\u636e\u5e93\u5bc6\u7801\u72ec\u7acb\u4e8e\u64cd\u4f5c\u7cfb\u7edf\u7528\u6237\u5bc6\u7801\u3002\u6bcf\u4e2a\u6570\u636e\u5e93\u7528\u6237\u7684\u5bc6\u7801\u90fd\u5b58\u50a8\u5728\u7cfb\u7edf\u76ee\u5f55 <code class=\"literal\">pg_authid</code> \u4e2d\u3002\u5bc6\u7801\u53ef\u4ee5\u901a\u8fc7 SQL \u547d\u4ee4<a class=\"xref\" href=\"/docs/13/sql-createrole.html\" title=\"CREATE ROLE\"><span class=\"refentrytitle\">CREATE ROLE</span></a>\u548c<a class=\"xref\" href=\"/docs/13/sql-alterrole.html\" title=\"ALTER ROLE\"><span class=\"refentrytitle\">ALTER ROLE</span></a>\u7ba1\u7406\uff0c\u4f8b\u5982 <strong class=\"userinput\"><code>CREATE ROLE foo WITH LOGIN PASSWORD 'secret'</code></strong>\uff0c\u6216\u8005\u901a\u8fc7 <span class=\"application\">psql</span> \u7684 <code class=\"literal\">\\password</code> \u547d\u4ee4\u7ba1\u7406\u3002\u5982\u679c\u67d0\u4e2a\u7528\u6237\u6ca1\u6709\u8bbe\u7f6e\u5bc6\u7801\uff0c\u5219\u5176\u5b58\u50a8\u5bc6\u7801\u4e3a null\uff0c\u8be5\u7528\u6237\u7684\u5bc6\u7801\u8ba4\u8bc1\u5c06\u59cb\u7ec8\u5931\u8d25\u3002</p>\n<p lang=\"zh\">\u4e0d\u540c\u57fa\u4e8e\u5bc6\u7801\u7684\u8ba4\u8bc1\u65b9\u6cd5\u662f\u5426\u53ef\u7528\uff0c\u53d6\u51b3\u4e8e\u7528\u6237\u5728\u670d\u52a1\u5668\u4e0a\u7684\u5bc6\u7801\u662f\u5982\u4f55\u52a0\u5bc6\u7684\uff08\u66f4\u51c6\u786e\u5730\u8bf4\uff0c\u662f\u5982\u4f55\u8fdb\u884c hash \u8fd0\u7b97\u7684\uff09\u3002\u8fd9\u7531\u8bbe\u7f6e\u5bc6\u7801\u65f6\u7684\u914d\u7f6e\u53c2\u6570<a class=\"xref\" href=\"/docs/13/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION\">password_encryption</a>\u63a7\u5236\u3002\u5982\u679c\u5bc6\u7801\u662f\u4f7f\u7528 <code class=\"literal\">scram-sha-256</code> \u8bbe\u7f6e\u52a0\u5bc6\u7684\uff0c\u90a3\u4e48\u5b83\u53ef\u4ee5\u7528\u4e8e <code class=\"literal\">scram-sha-256</code> \u548c <code class=\"literal\">password</code> \u8ba4\u8bc1\u65b9\u6cd5\uff08\u4f46\u540e\u4e00\u79cd\u60c5\u51b5\u4e0b\u5bc6\u7801\u4f1a\u4ee5\u660e\u6587\u4f20\u8f93\uff09\u3002\u5982\u4e0a\u6240\u8ff0\uff0c\u6b64\u65f6\u5982\u679c\u8ba4\u8bc1\u65b9\u6cd5\u6307\u5b9a\u4e3a <code class=\"literal\">md5</code>\uff0c\u4e5f\u4f1a\u81ea\u52a8\u5207\u6362\u4e3a\u4f7f\u7528 <code class=\"literal\">scram-sha-256</code>\uff0c\u56e0\u6b64\u540c\u6837\u80fd\u591f\u5de5\u4f5c\u3002\u5982\u679c\u5bc6\u7801\u662f\u4f7f\u7528 <code class=\"literal\">md5</code> \u8bbe\u7f6e\u52a0\u5bc6\u7684\uff0c\u90a3\u4e48\u5b83\u53ea\u80fd\u7528\u4e8e <code class=\"literal\">md5</code> \u548c <code class=\"literal\">password</code> \u8ba4\u8bc1\u65b9\u6cd5\uff08\u540c\u6837\uff0c\u540e\u4e00\u79cd\u60c5\u51b5\u4e0b\u5bc6\u7801\u4f1a\u4ee5\u660e\u6587\u4f20\u8f93\uff09\u3002\uff08\u4ee5\u524d\u7684 PostgreSQL \u7248\u672c\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u5b58\u50a8\u660e\u6587\u5bc6\u7801\uff0c\u4f46\u73b0\u5728\u5df2\u7ecf\u4e0d\u518d\u53ef\u80fd\u3002\uff09\u8981\u68c0\u67e5\u5f53\u524d\u5b58\u50a8\u7684\u5bc6\u7801 hash\uff0c\u53ef\u4ee5\u67e5\u770b\u7cfb\u7edf\u76ee\u5f55 <code class=\"literal\">pg_authid</code>\u3002</p>\n<p lang=\"zh\">\u8981\u5c06\u73b0\u6709\u5b89\u88c5\u4ece md5 \u5347\u7ea7\u5230 scram-sha-256\uff0c\u5e94\u5148\u786e\u8ba4\u6240\u6709\u4f7f\u7528\u4e2d\u7684\u5ba2\u6237\u7aef\u5e93\u7248\u672c\u90fd\u652f\u6301 SCRAM\uff1b\u7136\u540e\u5728 postgresql.conf \u4e2d\u8bbe\u7f6e password_encryption = 'scram-sha-256'\uff0c\u8ba9\u6240\u6709\u7528\u6237\u91cd\u65b0\u8bbe\u7f6e\u5bc6\u7801\uff0c\u5e76\u5c06 pg_hba.conf \u4e2d\u7684\u8ba4\u8bc1\u65b9\u6cd5\u6539\u4e3a scram-sha-256\u3002</p>\n</div>", "manual_path": "/docs/13/auth-password.html", "localization": {"status": "complete", "sources": [{"url": "/docs/13/auth-password.html", "method": "same-major semantic node", "sha256": "b4dc6d908b5797014a6ffb37d0ffb97e56b6ffc54d73d659a6fb4dc2663c2369", "language": "zh", "matched_nodes": ["#AUTH-PASSWORD/div[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]/p[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]/p[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[3]/p[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[3]/p[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[5]", "#AUTH-PASSWORD/p[4]", "#AUTH-PASSWORD/p[6]", "#AUTH-PASSWORD/p[7]"]}], "language": "zh", "original_text": {"/versions/13/description/0": "Require the client to supply an unencrypted password for authentication. Since the password is sent in clear text over the network, this should not be used on untrusted networks. See Section 20.5 for details.", "/versions/13/facts/0/label": "Method", "/versions/13/facts/1/label": "Configuration", "/versions/13/facts/2/label": "Inventory", "/versions/13/facts/2/value": "User-visible source authentication method", "/versions/13/tables/0/title": "Documented method options and alternatives", "/versions/13/tables/0/columns/0/label": "Option or term", "/versions/13/tables/0/columns/1/label": "Meaning", "/versions/13/tables/0/rows/0/description": "The method scram-sha-256 performs SCRAM-SHA-256 authentication, as described in RFC 7677 . It is a challenge-response scheme that prevents password sniffing on untrusted connections and supports storing passwords on the server in a cryptographically hashed form that is thought to be secure. This is the most secure of the currently provided methods, but it is not supported by older client libraries.", "/versions/13/tables/0/rows/1/description": "The method md5 uses a custom less secure challenge-response mechanism. It prevents password sniffing and avoids storing passwords on the server in plain text but provides no protection if an attacker manages to steal the password hash from the server. Also, the MD5 hash algorithm is nowadays no longer considered secure against determined attacks. The md5 method cannot be used with the db_user_namespace feature. To ease transition from the md5 method to the newer SCRAM method, if md5 is specified as a method in pg_hba.conf but the user's password on the server is encrypted for SCRAM (see below), then SCRAM-based authentication will automatically be chosen instead.", "/versions/13/tables/0/rows/2/description": "The method password sends the password in clear-text and is therefore vulnerable to password \u201c sniffing \u201d attacks. It should always be avoided if possible. If the connection is protected by SSL encryption then password can be used safely, though. (Though SSL certificate authentication might be a better choice if one is depending on using SSL)."}, "fallback_fields": [], "source_language": "en", "original_snapshot_sha256": "959d603cd68a4d2d3dbbc9349ea526472f51efbd06d01588e2ebc4588e1fbcc3"}, "comparison_data": {"method": "password", "documented_option_names": ["md5", "password", "scram-sha-256"]}, "comparison_hash": "d4a07ed4f297699ecd061181bcc656e57ea443c94b1d7536a172c08865099daf", "manual_language": "zh"}, "14": {"facts": [{"label": "\u65b9\u6cd5", "value": "password"}, {"label": "\u914d\u7f6e", "value": "pg_hba.conf"}, {"label": "\u6e05\u5355", "value": "\u7528\u6237\u53ef\u89c1\u7684\u6e90\u7801\u8ba4\u8bc1\u65b9\u6cd5"}], "tables": [{"key": "method-options", "rows": [{"name": "scram-sha-256", "description": "scram-sha-256 \u65b9\u6cd5\u6267\u884c SCRAM-SHA-256 \u8ba4\u8bc1\uff0c\u5176\u5b9a\u4e49\u89c1 RFC 7677 \u3002\u5b83\u662f\u4e00\u79cd\u6311\u6218-\u54cd\u5e94\u65b9\u6848\uff0c\u53ef\u9632\u6b62\u5728\u4e0d\u53d7\u4fe1\u4efb\u8fde\u63a5\u4e0a\u55c5\u63a2\u5bc6\u7801\uff0c\u5e76\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u88ab\u8ba4\u4e3a\u5b89\u5168\u7684\u5bc6\u7801\u5b66 hash \u5f62\u5f0f\u5b58\u50a8\u5bc6\u7801\u3002 \u8fd9\u662f\u5f53\u524d\u63d0\u4f9b\u7684\u65b9\u6cd5\u4e2d\u6700\u5b89\u5168\u7684\u4e00\u79cd\uff0c\u4f46\u662f\u65e7\u7684\u5ba2\u6237\u7aef\u5e93\u4e0d\u652f\u6301\u8fd9\u79cd\u65b9\u6cd5\u3002"}, {"name": "md5", "description": "md5 \u65b9\u6cd5\u4f7f\u7528\u81ea\u5b9a\u4e49\u4e14\u5b89\u5168\u6027\u8f83\u5f31\u7684\u6311\u6218\u54cd\u5e94\u673a\u5236\u3002\u5b83\u80fd\u9632\u6b62\u5bc6\u7801\u55c5\u63a2\uff0c\u907f\u514d\u670d\u52a1\u5668\u660e\u6587\u5b58\u50a8\u5bc6\u7801\uff1b\u4f46\u653b\u51fb\u8005\u4e00\u65e6\u7a83\u53d6\u670d\u52a1\u5668\u4e0a\u7684\u5bc6\u7801\u54c8\u5e0c\uff0c\u5c31\u65e0\u6cd5\u63d0\u4f9b\u4fdd\u62a4\u3002\u6b64\u5916\uff0cMD5 \u54c8\u5e0c\u7b97\u6cd5\u5982\u4eca\u5df2\u4e0d\u518d\u88ab\u8ba4\u4e3a\u80fd\u5b89\u5168\u62b5\u5fa1\u6709\u9488\u5bf9\u6027\u7684\u653b\u51fb\u3002md5 \u65b9\u6cd5\u4e0d\u80fd\u4e0e db_user_namespace \u529f\u80fd\u4e00\u8d77\u4f7f\u7528\u3002\u4e3a\u4fbf\u4e8e\u4ece md5 \u8fc1\u79fb\u5230\u8f83\u65b0\u7684 SCRAM \u65b9\u6cd5\uff0c\u5982\u679c pg_hba.conf \u4e2d\u6307\u5b9a md5\uff0c\u4f46\u670d\u52a1\u5668\u4e0a\u8be5\u7528\u6237\u7684\u5bc6\u7801\u91c7\u7528 SCRAM \u52a0\u5bc6\u5b58\u50a8\uff08\u89c1\u4e0b\u6587\uff09\uff0c\u7cfb\u7edf\u4f1a\u81ea\u52a8\u6539\u7528\u57fa\u4e8e SCRAM \u7684\u8ba4\u8bc1\u3002"}, {"name": "password", "description": "\u65b9\u6cd5 password \u4ee5\u660e\u6587\u5f62\u5f0f\u53d1\u9001\u5bc6\u7801\uff0c\u56e0\u6b64\u5b83\u5bb9\u6613\u53d7\u5230\u5bc6\u7801 \u201c \u55c5\u63a2 \u201d \u653b\u51fb\u3002\u5982\u679c\u53ef\u80fd\u5e94\u8be5\u5c3d\u91cf\u907f\u514d\u4f7f\u7528\u5b83\u3002\u4e0d\u8fc7\uff0c\u5982\u679c\u8fde\u63a5\u88abSSL\u52a0\u5bc6\u4fdd\u62a4\u7740\uff0c\u90a3\u4e48\u53ef\u4ee5\u5b89\u5168\u5730\u4f7f\u7528 password \uff08\u4e0d\u8fc7\u5982\u679c\u4f9d\u9760SSL\uff0cSSL\u8bc1\u4e66\u8ba4\u8bc1\u53ef\u80fd\u662f\u66f4\u597d\u7684\u9009\u62e9\uff09\u3002"}], "title": "\u624b\u518c\u4e2d\u7684\u65b9\u6cd5\u9009\u9879\u4e0e\u66ff\u4ee3\u65b9\u5f0f", "columns": [{"key": "name", "label": "\u9009\u9879\u6216\u672f\u8bed"}, {"key": "description", "label": "\u542b\u4e49"}]}], "aliases": [], "related": [], "release": {"ref": "https://ftp.postgresql.org/pub/source/v14.24/postgresql-14.24.tar.bz2", "label": "14.24", "major": "14", "channel": "stable", "revision": "a7fa7ed3d558172355f51406097a7bd4f6b473be80f311ef7cda96bf383d8897", "source_sha256": "a7fa7ed3d558172355f51406097a7bd4f6b473be80f311ef7cda96bf383d8897", "catalog_fingerprint": "b272e6a82e4c46efda81c3a6a4cdf7de6a83dfff7f02f226a392fbe9acdd3adb"}, "sources": [{"url": "https://ftp.postgresql.org/pub/source/v14.24/postgresql-14.24.tar.bz2", "label": "Matching PostgreSQL source archive", "sha256": "a7fa7ed3d558172355f51406097a7bd4f6b473be80f311ef7cda96bf383d8897"}, {"url": "https://pg.center/docs/14/auth-password.html", "path": "auth-password.html", "label": "PostgreSQL 14 English manual", "sha256": "fc4a9c1cae83361299edd3c455f2c74b08be1999411c7c7beeab07ffe27c72b1", "language": "en", "original_url": "/docs/14/auth-password.html"}, {"url": "https://pg.center/docs/14/auth-pg-hba-conf.html", "path": "auth-pg-hba-conf.html", "label": "PostgreSQL 14 English manual", "sha256": "c9a75f04fd4a1069ea261ba061578a75c47a4b7e0bbf88761502fd4c19ccbc3f", "language": "en", "original_url": "/docs/14/auth-pg-hba-conf.html"}], "sections": [], "signature": "", "attributes": {"method": "password", "inventory": "User-visible source authentication method", "configuration": "pg_hba.conf"}, "description": ["\u8981\u6c42\u5ba2\u6237\u7aef\u63d0\u4f9b\u672a\u7ecf\u52a0\u5bc6\u7684\u5bc6\u7801\u8fdb\u884c\u8ba4\u8bc1\u3002\u7531\u4e8e\u5bc6\u7801\u901a\u8fc7\u7f51\u7edc\u660e\u6587\u4f20\u8f93\uff0c\u4e0d\u5e94\u5728\u4e0d\u53ef\u4fe1\u7f51\u7edc\u4e0a\u4f7f\u7528\u3002\u8be6\u60c5\u53c2\u89c1\u7b2c 21.5 \u8282\u3002"], "manual_html": "<div class=\"sect1\" id=\"AUTH-PASSWORD\">\n<div class=\"titlepage\">\n<div>\n<div>\n<h2 class=\"title\" lang=\"zh\">\n<div>\n<div>\n<h2 class=\"title\" style=\"clear: both\">21.5.\u00a0\u5bc6\u7801\u8ba4\u8bc1 </h2>\n</div>\n</div>\n</h2>\n</div>\n</div>\n</div>\n<p lang=\"zh\">\u6709\u51e0\u79cd\u57fa\u4e8e\u5bc6\u7801\u7684\u8ba4\u8bc1\u65b9\u6cd5\u3002\u8fd9\u4e9b\u65b9\u6cd5\u7684\u8fc7\u7a0b\u7c7b\u4f3c\uff0c\u4f46\u662f\u533a\u522b\u5728\u4e8e\u7528\u6237\u5bc6\u7801\u5982\u4f55\u5b58\u653e\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u53ca\u5ba2\u6237\u7aef\u63d0\u4f9b\u7684\u5bc6\u7801\u5982\u4f55\u901a\u8fc7\u8fde\u63a5\u53d1\u9001\u3002</p>\n<div class=\"variablelist\">\n<dl class=\"variablelist\">\n<dt><span class=\"term\"><code class=\"literal\">scram-sha-256</code></span></dt>\n<dd>\n<p lang=\"zh\"><code class=\"literal\">scram-sha-256</code> \u65b9\u6cd5\u6267\u884c SCRAM-SHA-256 \u8ba4\u8bc1\uff0c\u5176\u5b9a\u4e49\u89c1 <a class=\"ulink\" href=\"https://datatracker.ietf.org/doc/html/rfc7677\" target=\"_top\">RFC 7677</a>\u3002\u5b83\u662f\u4e00\u79cd\u6311\u6218-\u54cd\u5e94\u65b9\u6848\uff0c\u53ef\u9632\u6b62\u5728\u4e0d\u53d7\u4fe1\u4efb\u8fde\u63a5\u4e0a\u55c5\u63a2\u5bc6\u7801\uff0c\u5e76\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u88ab\u8ba4\u4e3a\u5b89\u5168\u7684\u5bc6\u7801\u5b66 hash \u5f62\u5f0f\u5b58\u50a8\u5bc6\u7801\u3002</p>\n<p lang=\"zh\">\u8fd9\u662f\u5f53\u524d\u63d0\u4f9b\u7684\u65b9\u6cd5\u4e2d\u6700\u5b89\u5168\u7684\u4e00\u79cd\uff0c\u4f46\u662f\u65e7\u7684\u5ba2\u6237\u7aef\u5e93\u4e0d\u652f\u6301\u8fd9\u79cd\u65b9\u6cd5\u3002</p>\n</dd>\n<dt><span class=\"term\"><code class=\"literal\">md5</code></span></dt>\n<dd>\n<p lang=\"zh\">\u65b9\u6cd5<code class=\"literal\">md5</code>\u4f7f\u7528\u4e00\u79cd\u81ea\u5b9a\u4e49\u7684\u3001\u5b89\u5168\u6027\u8f83\u4f4e\u7684\u6311\u6218-\u54cd\u5e94\u673a\u5236\u3002\u5b83\u80fd\u9632\u6b62\u5bc6\u7801\u55c5\u63a2\uff0c\u5e76\u907f\u514d\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u660e\u6587\u5b58\u50a8\u5bc6\u7801\uff1b\u4f46\u5982\u679c\u653b\u51fb\u8005\u8bbe\u6cd5\u4ece\u670d\u52a1\u5668\u4e0a\u7a83\u53d6\u4e86\u5bc6\u7801 hash\uff0c\u5b83\u5c31\u65e0\u6cd5\u63d0\u4f9b\u4fdd\u62a4\u3002\u6b64\u5916\uff0c\u5982\u4eca\u5df2\u4e0d\u518d\u8ba4\u4e3a MD5 hash \u7b97\u6cd5\u80fd\u62b5\u5fa1\u6709\u51b3\u5fc3\u7684\u653b\u51fb\u8005\u3002</p>\n<p lang=\"zh\"><code class=\"literal\">md5</code>\u65b9\u6cd5\u4e0d\u80fd\u4e0e<a class=\"xref\" href=\"/docs/14/runtime-config-connection.html#GUC-DB-USER-NAMESPACE\">db_user_namespace</a>\u529f\u80fd\u4e00\u8d77\u4f7f\u7528\u3002</p>\n<p lang=\"zh\">\u4e3a\u4fbf\u4e8e\u4ece md5 \u8fc1\u79fb\u5230\u8f83\u65b0\u7684 SCRAM \u65b9\u6cd5\uff0c\u5982\u679c pg_hba.conf \u4e2d\u6307\u5b9a md5\uff0c\u4f46\u670d\u52a1\u5668\u4e0a\u8be5\u7528\u6237\u7684\u5bc6\u7801\u91c7\u7528 SCRAM \u52a0\u5bc6\u5b58\u50a8\uff08\u89c1\u4e0b\u6587\uff09\uff0c\u7cfb\u7edf\u4f1a\u81ea\u52a8\u6539\u7528\u57fa\u4e8e SCRAM \u7684\u8ba4\u8bc1\u3002</p>\n</dd>\n<dt><span class=\"term\"><code class=\"literal\">password</code></span></dt>\n<dd>\n<p lang=\"zh\">\n<p>\u65b9\u6cd5<code class=\"literal\">password</code>\u4ee5\u660e\u6587\u5f62\u5f0f\u53d1\u9001\u5bc6\u7801\uff0c\u56e0\u6b64\u5b83\u5bb9\u6613\u53d7\u5230\u5bc6\u7801<span class=\"quote\">\u201c<span class=\"quote\">\u55c5\u63a2</span>\u201d</span>\u653b\u51fb\u3002\u5982\u679c\u53ef\u80fd\u5e94\u8be5\u5c3d\u91cf\u907f\u514d\u4f7f\u7528\u5b83\u3002\u4e0d\u8fc7\uff0c\u5982\u679c\u8fde\u63a5\u88abSSL\u52a0\u5bc6\u4fdd\u62a4\u7740\uff0c\u90a3\u4e48\u53ef\u4ee5\u5b89\u5168\u5730\u4f7f\u7528<code class=\"literal\">password</code>\uff08\u4e0d\u8fc7\u5982\u679c\u4f9d\u9760SSL\uff0cSSL\u8bc1\u4e66\u8ba4\u8bc1\u53ef\u80fd\u662f\u66f4\u597d\u7684\u9009\u62e9\uff09\u3002</p>\n</p>\n</dd>\n</dl>\n</div>\n<p lang=\"zh\"><span class=\"productname\">PostgreSQL</span> \u6570\u636e\u5e93\u5bc6\u7801\u72ec\u7acb\u4e8e\u64cd\u4f5c\u7cfb\u7edf\u7528\u6237\u5bc6\u7801\u3002\u6bcf\u4e2a\u6570\u636e\u5e93\u7528\u6237\u7684\u5bc6\u7801\u90fd\u5b58\u50a8\u5728\u7cfb\u7edf\u76ee\u5f55 <code class=\"literal\">pg_authid</code> \u4e2d\u3002\u5bc6\u7801\u53ef\u4ee5\u901a\u8fc7 SQL \u547d\u4ee4<a class=\"xref\" href=\"/docs/14/sql-createrole.html\" title=\"CREATE ROLE\"><span class=\"refentrytitle\">CREATE ROLE</span></a>\u548c<a class=\"xref\" href=\"/docs/14/sql-alterrole.html\" title=\"ALTER ROLE\"><span class=\"refentrytitle\">ALTER ROLE</span></a>\u7ba1\u7406\uff0c\u4f8b\u5982 <strong class=\"userinput\"><code>CREATE ROLE foo WITH LOGIN PASSWORD 'secret'</code></strong>\uff0c\u6216\u8005\u901a\u8fc7 <span class=\"application\">psql</span> \u7684 <code class=\"literal\">\\password</code> \u547d\u4ee4\u7ba1\u7406\u3002\u5982\u679c\u67d0\u4e2a\u7528\u6237\u6ca1\u6709\u8bbe\u7f6e\u5bc6\u7801\uff0c\u5219\u5176\u5b58\u50a8\u5bc6\u7801\u4e3a null\uff0c\u8be5\u7528\u6237\u7684\u5bc6\u7801\u8ba4\u8bc1\u5c06\u59cb\u7ec8\u5931\u8d25\u3002</p>\n<p lang=\"zh\">\u4e0d\u540c\u57fa\u4e8e\u5bc6\u7801\u7684\u8ba4\u8bc1\u65b9\u6cd5\u662f\u5426\u53ef\u7528\uff0c\u53d6\u51b3\u4e8e\u7528\u6237\u5728\u670d\u52a1\u5668\u4e0a\u7684\u5bc6\u7801\u662f\u5982\u4f55\u52a0\u5bc6\u7684\uff08\u66f4\u51c6\u786e\u5730\u8bf4\uff0c\u662f\u5982\u4f55\u8fdb\u884c hash \u8fd0\u7b97\u7684\uff09\u3002\u8fd9\u7531\u8bbe\u7f6e\u5bc6\u7801\u65f6\u7684\u914d\u7f6e\u53c2\u6570<a class=\"xref\" href=\"/docs/14/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION\">password_encryption</a>\u63a7\u5236\u3002\u5982\u679c\u5bc6\u7801\u662f\u4f7f\u7528 <code class=\"literal\">scram-sha-256</code> \u8bbe\u7f6e\u52a0\u5bc6\u7684\uff0c\u90a3\u4e48\u5b83\u53ef\u4ee5\u7528\u4e8e <code class=\"literal\">scram-sha-256</code> \u548c <code class=\"literal\">password</code> \u8ba4\u8bc1\u65b9\u6cd5\uff08\u4f46\u540e\u4e00\u79cd\u60c5\u51b5\u4e0b\u5bc6\u7801\u4f1a\u4ee5\u660e\u6587\u4f20\u8f93\uff09\u3002\u5982\u4e0a\u6240\u8ff0\uff0c\u6b64\u65f6\u5982\u679c\u8ba4\u8bc1\u65b9\u6cd5\u6307\u5b9a\u4e3a <code class=\"literal\">md5</code>\uff0c\u4e5f\u4f1a\u81ea\u52a8\u5207\u6362\u4e3a\u4f7f\u7528 <code class=\"literal\">scram-sha-256</code>\uff0c\u56e0\u6b64\u540c\u6837\u80fd\u591f\u5de5\u4f5c\u3002\u5982\u679c\u5bc6\u7801\u662f\u4f7f\u7528 <code class=\"literal\">md5</code> \u8bbe\u7f6e\u52a0\u5bc6\u7684\uff0c\u90a3\u4e48\u5b83\u53ea\u80fd\u7528\u4e8e <code class=\"literal\">md5</code> \u548c <code class=\"literal\">password</code> \u8ba4\u8bc1\u65b9\u6cd5\uff08\u540c\u6837\uff0c\u540e\u4e00\u79cd\u60c5\u51b5\u4e0b\u5bc6\u7801\u4f1a\u4ee5\u660e\u6587\u4f20\u8f93\uff09\u3002\uff08\u4ee5\u524d\u7684 PostgreSQL \u7248\u672c\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u5b58\u50a8\u660e\u6587\u5bc6\u7801\uff0c\u4f46\u73b0\u5728\u5df2\u7ecf\u4e0d\u518d\u53ef\u80fd\u3002\uff09\u8981\u68c0\u67e5\u5f53\u524d\u5b58\u50a8\u7684\u5bc6\u7801 hash\uff0c\u53ef\u4ee5\u67e5\u770b\u7cfb\u7edf\u76ee\u5f55 <code class=\"literal\">pg_authid</code>\u3002</p>\n<p lang=\"zh\">\u8981\u5c06\u73b0\u6709\u5b89\u88c5\u4ece md5 \u5347\u7ea7\u5230 scram-sha-256\uff0c\u5e94\u5148\u786e\u8ba4\u6240\u6709\u4f7f\u7528\u4e2d\u7684\u5ba2\u6237\u7aef\u5e93\u7248\u672c\u90fd\u652f\u6301 SCRAM\uff1b\u7136\u540e\u5728 postgresql.conf \u4e2d\u8bbe\u7f6e password_encryption = 'scram-sha-256'\uff0c\u8ba9\u6240\u6709\u7528\u6237\u91cd\u65b0\u8bbe\u7f6e\u5bc6\u7801\uff0c\u5e76\u5c06 pg_hba.conf \u4e2d\u7684\u8ba4\u8bc1\u65b9\u6cd5\u6539\u4e3a scram-sha-256\u3002</p>\n</div>", "manual_path": "/docs/14/auth-password.html", "localization": {"status": "complete", "sources": [{"url": "/docs/14/auth-password.html", "method": "same-major semantic node", "sha256": "a941ef11a441ac54a8c838b73f61d7035861bbd5ed7d36175ff72b20549d98ee", "language": "zh", "matched_nodes": ["#AUTH-PASSWORD/div[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]/p[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]/p[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[3]/p[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[3]/p[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[5]", "#AUTH-PASSWORD/p[4]", "#AUTH-PASSWORD/p[6]", "#AUTH-PASSWORD/p[7]"]}], "language": "zh", "original_text": {"/versions/14/description/0": "Require the client to supply an unencrypted password for authentication. Since the password is sent in clear text over the network, this should not be used on untrusted networks. See Section 21.5 for details.", "/versions/14/facts/0/label": "Method", "/versions/14/facts/1/label": "Configuration", "/versions/14/facts/2/label": "Inventory", "/versions/14/facts/2/value": "User-visible source authentication method", "/versions/14/tables/0/title": "Documented method options and alternatives", "/versions/14/tables/0/columns/0/label": "Option or term", "/versions/14/tables/0/columns/1/label": "Meaning", "/versions/14/tables/0/rows/0/description": "The method scram-sha-256 performs SCRAM-SHA-256 authentication, as described in RFC 7677 . It is a challenge-response scheme that prevents password sniffing on untrusted connections and supports storing passwords on the server in a cryptographically hashed form that is thought to be secure. This is the most secure of the currently provided methods, but it is not supported by older client libraries.", "/versions/14/tables/0/rows/1/description": "The method md5 uses a custom less secure challenge-response mechanism. It prevents password sniffing and avoids storing passwords on the server in plain text but provides no protection if an attacker manages to steal the password hash from the server. Also, the MD5 hash algorithm is nowadays no longer considered secure against determined attacks. The md5 method cannot be used with the db_user_namespace feature. To ease transition from the md5 method to the newer SCRAM method, if md5 is specified as a method in pg_hba.conf but the user's password on the server is encrypted for SCRAM (see below), then SCRAM-based authentication will automatically be chosen instead.", "/versions/14/tables/0/rows/2/description": "The method password sends the password in clear-text and is therefore vulnerable to password \u201c sniffing \u201d attacks. It should always be avoided if possible. If the connection is protected by SSL encryption then password can be used safely, though. (Though SSL certificate authentication might be a better choice if one is depending on using SSL)."}, "fallback_fields": [], "source_language": "en", "original_snapshot_sha256": "d260002b2d5aac83136e0043de658f2d4f87acdc0672a8729f2ea3ccca433f34"}, "comparison_data": {"method": "password", "documented_option_names": ["md5", "password", "scram-sha-256"]}, "comparison_hash": "d4a07ed4f297699ecd061181bcc656e57ea443c94b1d7536a172c08865099daf", "manual_language": "zh"}, "15": {"facts": [{"label": "\u65b9\u6cd5", "value": "password"}, {"label": "\u914d\u7f6e", "value": "pg_hba.conf"}, {"label": "\u6e05\u5355", "value": "\u7528\u6237\u53ef\u89c1\u7684\u6e90\u7801\u8ba4\u8bc1\u65b9\u6cd5"}], "tables": [{"key": "method-options", "rows": [{"name": "scram-sha-256", "description": "scram-sha-256 \u65b9\u6cd5\u6267\u884c SCRAM-SHA-256 \u8ba4\u8bc1\uff0c\u5176\u5b9a\u4e49\u89c1 RFC 7677 \u3002\u5b83\u662f\u4e00\u79cd\u6311\u6218-\u54cd\u5e94\u65b9\u6848\uff0c\u53ef\u9632\u6b62\u5728\u4e0d\u53d7\u4fe1\u4efb\u8fde\u63a5\u4e0a\u55c5\u63a2\u5bc6\u7801\uff0c\u5e76\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u88ab\u8ba4\u4e3a\u5b89\u5168\u7684\u5bc6\u7801\u5b66 hash \u5f62\u5f0f\u5b58\u50a8\u5bc6\u7801\u3002 \u8fd9\u662f\u5f53\u524d\u63d0\u4f9b\u7684\u65b9\u6cd5\u4e2d\u6700\u5b89\u5168\u7684\u4e00\u79cd\uff0c\u4f46\u662f\u65e7\u7684\u5ba2\u6237\u7aef\u5e93\u4e0d\u652f\u6301\u8fd9\u79cd\u65b9\u6cd5\u3002"}, {"name": "md5", "description": "md5 \u65b9\u6cd5\u4f7f\u7528\u81ea\u5b9a\u4e49\u4e14\u5b89\u5168\u6027\u8f83\u5f31\u7684\u6311\u6218\u54cd\u5e94\u673a\u5236\u3002\u5b83\u80fd\u9632\u6b62\u5bc6\u7801\u55c5\u63a2\uff0c\u907f\u514d\u670d\u52a1\u5668\u660e\u6587\u5b58\u50a8\u5bc6\u7801\uff1b\u4f46\u653b\u51fb\u8005\u4e00\u65e6\u7a83\u53d6\u670d\u52a1\u5668\u4e0a\u7684\u5bc6\u7801\u54c8\u5e0c\uff0c\u5c31\u65e0\u6cd5\u63d0\u4f9b\u4fdd\u62a4\u3002\u6b64\u5916\uff0cMD5 \u54c8\u5e0c\u7b97\u6cd5\u5982\u4eca\u5df2\u4e0d\u518d\u88ab\u8ba4\u4e3a\u80fd\u5b89\u5168\u62b5\u5fa1\u6709\u9488\u5bf9\u6027\u7684\u653b\u51fb\u3002md5 \u65b9\u6cd5\u4e0d\u80fd\u4e0e db_user_namespace \u529f\u80fd\u4e00\u8d77\u4f7f\u7528\u3002\u4e3a\u4fbf\u4e8e\u4ece md5 \u8fc1\u79fb\u5230\u8f83\u65b0\u7684 SCRAM \u65b9\u6cd5\uff0c\u5982\u679c pg_hba.conf \u4e2d\u6307\u5b9a md5\uff0c\u4f46\u670d\u52a1\u5668\u4e0a\u8be5\u7528\u6237\u7684\u5bc6\u7801\u91c7\u7528 SCRAM \u52a0\u5bc6\u5b58\u50a8\uff08\u89c1\u4e0b\u6587\uff09\uff0c\u7cfb\u7edf\u4f1a\u81ea\u52a8\u6539\u7528\u57fa\u4e8e SCRAM \u7684\u8ba4\u8bc1\u3002"}, {"name": "password", "description": "\u65b9\u6cd5 password \u4ee5\u660e\u6587\u5f62\u5f0f\u53d1\u9001\u5bc6\u7801\uff0c\u56e0\u6b64\u5b83\u5bb9\u6613\u53d7\u5230\u5bc6\u7801 \u201c \u55c5\u63a2 \u201d \u653b\u51fb\u3002\u5982\u679c\u53ef\u80fd\u5e94\u8be5\u5c3d\u91cf\u907f\u514d\u4f7f\u7528\u5b83\u3002\u4e0d\u8fc7\uff0c\u5982\u679c\u8fde\u63a5\u88abSSL\u52a0\u5bc6\u4fdd\u62a4\u7740\uff0c\u90a3\u4e48\u53ef\u4ee5\u5b89\u5168\u5730\u4f7f\u7528 password \uff08\u4e0d\u8fc7\u5982\u679c\u4f9d\u9760SSL\uff0cSSL\u8bc1\u4e66\u8ba4\u8bc1\u53ef\u80fd\u662f\u66f4\u597d\u7684\u9009\u62e9\uff09\u3002"}], "title": "\u624b\u518c\u4e2d\u7684\u65b9\u6cd5\u9009\u9879\u4e0e\u66ff\u4ee3\u65b9\u5f0f", "columns": [{"key": "name", "label": "\u9009\u9879\u6216\u672f\u8bed"}, {"key": "description", "label": "\u542b\u4e49"}]}], "aliases": [], "related": [], "release": {"ref": "https://ftp.postgresql.org/pub/source/v15.19/postgresql-15.19.tar.bz2", "label": "15.19", "major": "15", "channel": "stable", "revision": "e1a64a87a46b825b88c082e4518161a47aab53c45694964f8ba1df28f7859f89", "source_sha256": "e1a64a87a46b825b88c082e4518161a47aab53c45694964f8ba1df28f7859f89", "catalog_fingerprint": "fefe3c425147a86defada190c9b0663cfe02caa1724f5dede93e46457572252d"}, "sources": [{"url": "https://ftp.postgresql.org/pub/source/v15.19/postgresql-15.19.tar.bz2", "label": "Matching PostgreSQL source archive", "sha256": "e1a64a87a46b825b88c082e4518161a47aab53c45694964f8ba1df28f7859f89"}, {"url": "https://pg.center/docs/15/auth-password.html", "path": "auth-password.html", "label": "PostgreSQL 15 English manual", "sha256": "db530ef64e642d0f0ec06159d6cf49973161d0ebb40ef5700f8e1b64093ee2f2", "language": "en", "original_url": "/docs/15/auth-password.html"}, {"url": "https://pg.center/docs/15/auth-pg-hba-conf.html", "path": "auth-pg-hba-conf.html", "label": "PostgreSQL 15 English manual", "sha256": "0470cd3eeb82cbc32d4b8b79e29f4427bdfd01f5bb15e6d9b7cee2f6dd2bba44", "language": "en", "original_url": "/docs/15/auth-pg-hba-conf.html"}], "sections": [], "signature": "", "attributes": {"method": "password", "inventory": "User-visible source authentication method", "configuration": "pg_hba.conf"}, "description": ["\u8981\u6c42\u5ba2\u6237\u7aef\u63d0\u4f9b\u672a\u7ecf\u52a0\u5bc6\u7684\u5bc6\u7801\u8fdb\u884c\u8ba4\u8bc1\u3002\u7531\u4e8e\u5bc6\u7801\u901a\u8fc7\u7f51\u7edc\u660e\u6587\u4f20\u8f93\uff0c\u4e0d\u5e94\u5728\u4e0d\u53ef\u4fe1\u7f51\u7edc\u4e0a\u4f7f\u7528\u3002\u8be6\u60c5\u53c2\u89c1\u7b2c 21.5 \u8282\u3002"], "manual_html": "<div class=\"sect1\" id=\"AUTH-PASSWORD\">\n<div class=\"titlepage\">\n<div>\n<div>\n<h2 class=\"title\" lang=\"zh\">\n<div>\n<div>\n<h2 class=\"title\" style=\"clear: both\">21.5.\u00a0\u5bc6\u7801\u8ba4\u8bc1 </h2>\n</div>\n</div>\n</h2>\n</div>\n</div>\n</div>\n<p lang=\"zh\">\u6709\u51e0\u79cd\u57fa\u4e8e\u5bc6\u7801\u7684\u8ba4\u8bc1\u65b9\u6cd5\u3002\u8fd9\u4e9b\u65b9\u6cd5\u7684\u8fc7\u7a0b\u7c7b\u4f3c\uff0c\u4f46\u662f\u533a\u522b\u5728\u4e8e\u7528\u6237\u5bc6\u7801\u5982\u4f55\u5b58\u653e\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u53ca\u5ba2\u6237\u7aef\u63d0\u4f9b\u7684\u5bc6\u7801\u5982\u4f55\u901a\u8fc7\u8fde\u63a5\u53d1\u9001\u3002</p>\n<div class=\"variablelist\">\n<dl class=\"variablelist\">\n<dt><span class=\"term\"><code class=\"literal\">scram-sha-256</code></span></dt>\n<dd>\n<p lang=\"zh\"><code class=\"literal\">scram-sha-256</code> \u65b9\u6cd5\u6267\u884c SCRAM-SHA-256 \u8ba4\u8bc1\uff0c\u5176\u5b9a\u4e49\u89c1 <a class=\"ulink\" href=\"https://datatracker.ietf.org/doc/html/rfc7677\" target=\"_top\">RFC 7677</a>\u3002\u5b83\u662f\u4e00\u79cd\u6311\u6218-\u54cd\u5e94\u65b9\u6848\uff0c\u53ef\u9632\u6b62\u5728\u4e0d\u53d7\u4fe1\u4efb\u8fde\u63a5\u4e0a\u55c5\u63a2\u5bc6\u7801\uff0c\u5e76\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u88ab\u8ba4\u4e3a\u5b89\u5168\u7684\u5bc6\u7801\u5b66 hash \u5f62\u5f0f\u5b58\u50a8\u5bc6\u7801\u3002</p>\n<p lang=\"zh\">\u8fd9\u662f\u5f53\u524d\u63d0\u4f9b\u7684\u65b9\u6cd5\u4e2d\u6700\u5b89\u5168\u7684\u4e00\u79cd\uff0c\u4f46\u662f\u65e7\u7684\u5ba2\u6237\u7aef\u5e93\u4e0d\u652f\u6301\u8fd9\u79cd\u65b9\u6cd5\u3002</p>\n</dd>\n<dt><span class=\"term\"><code class=\"literal\">md5</code></span></dt>\n<dd>\n<p lang=\"zh\">\u65b9\u6cd5<code class=\"literal\">md5</code>\u4f7f\u7528\u4e00\u79cd\u81ea\u5b9a\u4e49\u7684\u3001\u5b89\u5168\u6027\u8f83\u4f4e\u7684\u6311\u6218-\u54cd\u5e94\u673a\u5236\u3002\u5b83\u80fd\u9632\u6b62\u5bc6\u7801\u55c5\u63a2\uff0c\u5e76\u907f\u514d\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u660e\u6587\u5b58\u50a8\u5bc6\u7801\uff1b\u4f46\u5982\u679c\u653b\u51fb\u8005\u8bbe\u6cd5\u4ece\u670d\u52a1\u5668\u4e0a\u7a83\u53d6\u4e86\u5bc6\u7801 hash\uff0c\u5b83\u5c31\u65e0\u6cd5\u63d0\u4f9b\u4fdd\u62a4\u3002\u6b64\u5916\uff0c\u5982\u4eca\u5df2\u4e0d\u518d\u8ba4\u4e3a MD5 hash \u7b97\u6cd5\u80fd\u62b5\u5fa1\u6709\u51b3\u5fc3\u7684\u653b\u51fb\u8005\u3002</p>\n<p lang=\"zh\"><code class=\"literal\">md5</code>\u65b9\u6cd5\u4e0d\u80fd\u4e0e<a class=\"xref\" href=\"/docs/15/runtime-config-connection.html#GUC-DB-USER-NAMESPACE\">db_user_namespace</a>\u529f\u80fd\u4e00\u8d77\u4f7f\u7528\u3002</p>\n<p lang=\"zh\">\u4e3a\u4fbf\u4e8e\u4ece md5 \u8fc1\u79fb\u5230\u8f83\u65b0\u7684 SCRAM \u65b9\u6cd5\uff0c\u5982\u679c pg_hba.conf \u4e2d\u6307\u5b9a md5\uff0c\u4f46\u670d\u52a1\u5668\u4e0a\u8be5\u7528\u6237\u7684\u5bc6\u7801\u91c7\u7528 SCRAM \u52a0\u5bc6\u5b58\u50a8\uff08\u89c1\u4e0b\u6587\uff09\uff0c\u7cfb\u7edf\u4f1a\u81ea\u52a8\u6539\u7528\u57fa\u4e8e SCRAM \u7684\u8ba4\u8bc1\u3002</p>\n</dd>\n<dt><span class=\"term\"><code class=\"literal\">password</code></span></dt>\n<dd>\n<p lang=\"zh\">\n<p>\u65b9\u6cd5<code class=\"literal\">password</code>\u4ee5\u660e\u6587\u5f62\u5f0f\u53d1\u9001\u5bc6\u7801\uff0c\u56e0\u6b64\u5b83\u5bb9\u6613\u53d7\u5230\u5bc6\u7801<span class=\"quote\">\u201c<span class=\"quote\">\u55c5\u63a2</span>\u201d</span>\u653b\u51fb\u3002\u5982\u679c\u53ef\u80fd\u5e94\u8be5\u5c3d\u91cf\u907f\u514d\u4f7f\u7528\u5b83\u3002\u4e0d\u8fc7\uff0c\u5982\u679c\u8fde\u63a5\u88abSSL\u52a0\u5bc6\u4fdd\u62a4\u7740\uff0c\u90a3\u4e48\u53ef\u4ee5\u5b89\u5168\u5730\u4f7f\u7528<code class=\"literal\">password</code>\uff08\u4e0d\u8fc7\u5982\u679c\u4f9d\u9760SSL\uff0cSSL\u8bc1\u4e66\u8ba4\u8bc1\u53ef\u80fd\u662f\u66f4\u597d\u7684\u9009\u62e9\uff09\u3002</p>\n</p>\n</dd>\n</dl>\n</div>\n<p lang=\"zh\"><span class=\"productname\">PostgreSQL</span> \u6570\u636e\u5e93\u5bc6\u7801\u72ec\u7acb\u4e8e\u64cd\u4f5c\u7cfb\u7edf\u7528\u6237\u5bc6\u7801\u3002\u6bcf\u4e2a\u6570\u636e\u5e93\u7528\u6237\u7684\u5bc6\u7801\u90fd\u5b58\u50a8\u5728\u7cfb\u7edf\u76ee\u5f55 <code class=\"literal\">pg_authid</code> \u4e2d\u3002\u5bc6\u7801\u53ef\u4ee5\u901a\u8fc7 SQL \u547d\u4ee4<a class=\"xref\" href=\"/docs/15/sql-createrole.html\" title=\"CREATE ROLE\"><span class=\"refentrytitle\">CREATE ROLE</span></a>\u548c<a class=\"xref\" href=\"/docs/15/sql-alterrole.html\" title=\"ALTER ROLE\"><span class=\"refentrytitle\">ALTER ROLE</span></a>\u7ba1\u7406\uff0c\u4f8b\u5982 <strong class=\"userinput\"><code>CREATE ROLE foo WITH LOGIN PASSWORD 'secret'</code></strong>\uff0c\u6216\u8005\u901a\u8fc7 <span class=\"application\">psql</span> \u7684 <code class=\"literal\">\\password</code> \u547d\u4ee4\u7ba1\u7406\u3002\u5982\u679c\u67d0\u4e2a\u7528\u6237\u6ca1\u6709\u8bbe\u7f6e\u5bc6\u7801\uff0c\u5219\u5176\u5b58\u50a8\u5bc6\u7801\u4e3a null\uff0c\u8be5\u7528\u6237\u7684\u5bc6\u7801\u8ba4\u8bc1\u5c06\u59cb\u7ec8\u5931\u8d25\u3002</p>\n<p lang=\"zh\">\u4e0d\u540c\u57fa\u4e8e\u5bc6\u7801\u7684\u8ba4\u8bc1\u65b9\u6cd5\u662f\u5426\u53ef\u7528\uff0c\u53d6\u51b3\u4e8e\u7528\u6237\u5728\u670d\u52a1\u5668\u4e0a\u7684\u5bc6\u7801\u662f\u5982\u4f55\u52a0\u5bc6\u7684\uff08\u66f4\u51c6\u786e\u5730\u8bf4\uff0c\u662f\u5982\u4f55\u8fdb\u884c hash \u8fd0\u7b97\u7684\uff09\u3002\u8fd9\u7531\u8bbe\u7f6e\u5bc6\u7801\u65f6\u7684\u914d\u7f6e\u53c2\u6570<a class=\"xref\" href=\"/docs/15/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION\">password_encryption</a>\u63a7\u5236\u3002\u5982\u679c\u5bc6\u7801\u662f\u4f7f\u7528 <code class=\"literal\">scram-sha-256</code> \u8bbe\u7f6e\u52a0\u5bc6\u7684\uff0c\u90a3\u4e48\u5b83\u53ef\u4ee5\u7528\u4e8e <code class=\"literal\">scram-sha-256</code> \u548c <code class=\"literal\">password</code> \u8ba4\u8bc1\u65b9\u6cd5\uff08\u4f46\u540e\u4e00\u79cd\u60c5\u51b5\u4e0b\u5bc6\u7801\u4f1a\u4ee5\u660e\u6587\u4f20\u8f93\uff09\u3002\u5982\u4e0a\u6240\u8ff0\uff0c\u6b64\u65f6\u5982\u679c\u8ba4\u8bc1\u65b9\u6cd5\u6307\u5b9a\u4e3a <code class=\"literal\">md5</code>\uff0c\u4e5f\u4f1a\u81ea\u52a8\u5207\u6362\u4e3a\u4f7f\u7528 <code class=\"literal\">scram-sha-256</code>\uff0c\u56e0\u6b64\u540c\u6837\u80fd\u591f\u5de5\u4f5c\u3002\u5982\u679c\u5bc6\u7801\u662f\u4f7f\u7528 <code class=\"literal\">md5</code> \u8bbe\u7f6e\u52a0\u5bc6\u7684\uff0c\u90a3\u4e48\u5b83\u53ea\u80fd\u7528\u4e8e <code class=\"literal\">md5</code> \u548c <code class=\"literal\">password</code> \u8ba4\u8bc1\u65b9\u6cd5\uff08\u540c\u6837\uff0c\u540e\u4e00\u79cd\u60c5\u51b5\u4e0b\u5bc6\u7801\u4f1a\u4ee5\u660e\u6587\u4f20\u8f93\uff09\u3002\uff08\u4ee5\u524d\u7684 PostgreSQL \u7248\u672c\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u5b58\u50a8\u660e\u6587\u5bc6\u7801\uff0c\u4f46\u73b0\u5728\u5df2\u7ecf\u4e0d\u518d\u53ef\u80fd\u3002\uff09\u8981\u68c0\u67e5\u5f53\u524d\u5b58\u50a8\u7684\u5bc6\u7801 hash\uff0c\u53ef\u4ee5\u67e5\u770b\u7cfb\u7edf\u76ee\u5f55 <code class=\"literal\">pg_authid</code>\u3002</p>\n<p lang=\"zh\">\u8981\u5c06\u73b0\u6709\u5b89\u88c5\u4ece md5 \u5347\u7ea7\u5230 scram-sha-256\uff0c\u5e94\u5148\u786e\u8ba4\u6240\u6709\u4f7f\u7528\u4e2d\u7684\u5ba2\u6237\u7aef\u5e93\u7248\u672c\u90fd\u652f\u6301 SCRAM\uff1b\u7136\u540e\u5728 postgresql.conf \u4e2d\u8bbe\u7f6e password_encryption = 'scram-sha-256'\uff0c\u8ba9\u6240\u6709\u7528\u6237\u91cd\u65b0\u8bbe\u7f6e\u5bc6\u7801\uff0c\u5e76\u5c06 pg_hba.conf \u4e2d\u7684\u8ba4\u8bc1\u65b9\u6cd5\u6539\u4e3a scram-sha-256\u3002</p>\n</div>", "manual_path": "/docs/15/auth-password.html", "localization": {"status": "complete", "sources": [{"url": "/docs/15/auth-password.html", "method": "same-major semantic node", "sha256": "7444a760d1ec1b4ead0d482e91e83336ec15164a87cef4faa558298a07884794", "language": "zh", "matched_nodes": ["#AUTH-PASSWORD/div[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]/p[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]/p[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[3]/p[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[3]/p[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[5]", "#AUTH-PASSWORD/p[4]", "#AUTH-PASSWORD/p[6]", "#AUTH-PASSWORD/p[7]"]}], "language": "zh", "original_text": {"/versions/15/description/0": "Require the client to supply an unencrypted password for authentication. Since the password is sent in clear text over the network, this should not be used on untrusted networks. See Section 21.5 for details.", "/versions/15/facts/0/label": "Method", "/versions/15/facts/1/label": "Configuration", "/versions/15/facts/2/label": "Inventory", "/versions/15/facts/2/value": "User-visible source authentication method", "/versions/15/tables/0/title": "Documented method options and alternatives", "/versions/15/tables/0/columns/0/label": "Option or term", "/versions/15/tables/0/columns/1/label": "Meaning", "/versions/15/tables/0/rows/0/description": "The method scram-sha-256 performs SCRAM-SHA-256 authentication, as described in RFC 7677 . It is a challenge-response scheme that prevents password sniffing on untrusted connections and supports storing passwords on the server in a cryptographically hashed form that is thought to be secure. This is the most secure of the currently provided methods, but it is not supported by older client libraries.", "/versions/15/tables/0/rows/1/description": "The method md5 uses a custom less secure challenge-response mechanism. It prevents password sniffing and avoids storing passwords on the server in plain text but provides no protection if an attacker manages to steal the password hash from the server. Also, the MD5 hash algorithm is nowadays no longer considered secure against determined attacks. The md5 method cannot be used with the db_user_namespace feature. To ease transition from the md5 method to the newer SCRAM method, if md5 is specified as a method in pg_hba.conf but the user's password on the server is encrypted for SCRAM (see below), then SCRAM-based authentication will automatically be chosen instead.", "/versions/15/tables/0/rows/2/description": "The method password sends the password in clear-text and is therefore vulnerable to password \u201c sniffing \u201d attacks. It should always be avoided if possible. If the connection is protected by SSL encryption then password can be used safely, though. (Though SSL certificate authentication might be a better choice if one is depending on using SSL)."}, "fallback_fields": [], "source_language": "en", "original_snapshot_sha256": "12be7c7286eb7064ebc7af87a6028d3d540013081b661c51e4dcfeb75dc28bf5"}, "comparison_data": {"method": "password", "documented_option_names": ["md5", "password", "scram-sha-256"]}, "comparison_hash": "d4a07ed4f297699ecd061181bcc656e57ea443c94b1d7536a172c08865099daf", "manual_language": "zh"}, "16": {"facts": [{"label": "\u65b9\u6cd5", "value": "password"}, {"label": "\u914d\u7f6e", "value": "pg_hba.conf"}, {"label": "\u6e05\u5355", "value": "\u7528\u6237\u53ef\u89c1\u7684\u6e90\u7801\u8ba4\u8bc1\u65b9\u6cd5"}], "tables": [{"key": "method-options", "rows": [{"name": "scram-sha-256", "description": "scram-sha-256 \u65b9\u6cd5\u6267\u884c SCRAM-SHA-256 \u8ba4\u8bc1\uff0c\u5176\u5b9a\u4e49\u89c1 RFC 7677 \u3002\u5b83\u662f\u4e00\u79cd\u6311\u6218-\u54cd\u5e94\u65b9\u6848\uff0c\u53ef\u9632\u6b62\u5728\u4e0d\u53d7\u4fe1\u4efb\u8fde\u63a5\u4e0a\u55c5\u63a2\u5bc6\u7801\uff0c\u5e76\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u88ab\u8ba4\u4e3a\u5b89\u5168\u7684\u5bc6\u7801\u5b66 hash \u5f62\u5f0f\u5b58\u50a8\u5bc6\u7801\u3002 \u8fd9\u662f\u5f53\u524d\u63d0\u4f9b\u7684\u65b9\u6cd5\u4e2d\u6700\u5b89\u5168\u7684\u4e00\u79cd\uff0c\u4f46\u662f\u65e7\u7684\u5ba2\u6237\u7aef\u5e93\u4e0d\u652f\u6301\u8fd9\u79cd\u65b9\u6cd5\u3002"}, {"name": "md5", "description": "md5 \u65b9\u6cd5\u4f7f\u7528\u81ea\u5b9a\u4e49\u4e14\u5b89\u5168\u6027\u8f83\u5f31\u7684\u6311\u6218\u54cd\u5e94\u673a\u5236\u3002\u5b83\u80fd\u9632\u6b62\u5bc6\u7801\u55c5\u63a2\uff0c\u907f\u514d\u670d\u52a1\u5668\u660e\u6587\u5b58\u50a8\u5bc6\u7801\uff1b\u4f46\u653b\u51fb\u8005\u4e00\u65e6\u7a83\u53d6\u670d\u52a1\u5668\u4e0a\u7684\u5bc6\u7801\u54c8\u5e0c\uff0c\u5c31\u65e0\u6cd5\u63d0\u4f9b\u4fdd\u62a4\u3002\u6b64\u5916\uff0cMD5 \u54c8\u5e0c\u7b97\u6cd5\u5982\u4eca\u5df2\u4e0d\u518d\u88ab\u8ba4\u4e3a\u80fd\u5b89\u5168\u62b5\u5fa1\u6709\u9488\u5bf9\u6027\u7684\u653b\u51fb\u3002md5 \u65b9\u6cd5\u4e0d\u80fd\u4e0e db_user_namespace \u529f\u80fd\u4e00\u8d77\u4f7f\u7528\u3002\u4e3a\u4fbf\u4e8e\u4ece md5 \u8fc1\u79fb\u5230\u8f83\u65b0\u7684 SCRAM \u65b9\u6cd5\uff0c\u5982\u679c pg_hba.conf \u4e2d\u6307\u5b9a md5\uff0c\u4f46\u670d\u52a1\u5668\u4e0a\u8be5\u7528\u6237\u7684\u5bc6\u7801\u91c7\u7528 SCRAM \u52a0\u5bc6\u5b58\u50a8\uff08\u89c1\u4e0b\u6587\uff09\uff0c\u7cfb\u7edf\u4f1a\u81ea\u52a8\u6539\u7528\u57fa\u4e8e SCRAM \u7684\u8ba4\u8bc1\u3002"}, {"name": "password", "description": "\u65b9\u6cd5 password \u4ee5\u660e\u6587\u5f62\u5f0f\u53d1\u9001\u5bc6\u7801\uff0c\u56e0\u6b64\u5b83\u5bb9\u6613\u53d7\u5230\u5bc6\u7801 \u201c \u55c5\u63a2 \u201d \u653b\u51fb\u3002\u5982\u679c\u53ef\u80fd\u5e94\u8be5\u5c3d\u91cf\u907f\u514d\u4f7f\u7528\u5b83\u3002\u4e0d\u8fc7\uff0c\u5982\u679c\u8fde\u63a5\u88abSSL\u52a0\u5bc6\u4fdd\u62a4\u7740\uff0c\u90a3\u4e48\u53ef\u4ee5\u5b89\u5168\u5730\u4f7f\u7528 password \uff08\u4e0d\u8fc7\u5982\u679c\u4f9d\u9760SSL\uff0cSSL\u8bc1\u4e66\u8ba4\u8bc1\u53ef\u80fd\u662f\u66f4\u597d\u7684\u9009\u62e9\uff09\u3002"}], "title": "\u624b\u518c\u4e2d\u7684\u65b9\u6cd5\u9009\u9879\u4e0e\u66ff\u4ee3\u65b9\u5f0f", "columns": [{"key": "name", "label": "\u9009\u9879\u6216\u672f\u8bed"}, {"key": "description", "label": "\u542b\u4e49"}]}], "aliases": [], "related": [], "release": {"ref": "https://ftp.postgresql.org/pub/source/v16.15/postgresql-16.15.tar.bz2", "label": "16.15", "major": "16", "channel": "stable", "revision": "c1575341fa7bd40f5274ea465b34390f4dc64cdd0770af327005caaeb9f6b7ed", "source_sha256": "c1575341fa7bd40f5274ea465b34390f4dc64cdd0770af327005caaeb9f6b7ed", "catalog_fingerprint": "fa133458dc8f52e15083b4f59b7a582e2e378b608d3ac5c53054df458a374e23"}, "sources": [{"url": "https://ftp.postgresql.org/pub/source/v16.15/postgresql-16.15.tar.bz2", "label": "Matching PostgreSQL source archive", "sha256": "c1575341fa7bd40f5274ea465b34390f4dc64cdd0770af327005caaeb9f6b7ed"}, {"url": "https://pg.center/docs/16/auth-password.html", "path": "auth-password.html", "label": "PostgreSQL 16 English manual", "sha256": "1e33b5a05b349634266e1e433229d99ff7476113634574cf861c050039e7cead", "language": "en", "original_url": "/docs/16/auth-password.html"}, {"url": "https://pg.center/docs/16/auth-pg-hba-conf.html", "path": "auth-pg-hba-conf.html", "label": "PostgreSQL 16 English manual", "sha256": "ccc5146375a184646d5992edbc693e12c0de4431a35141d6b56c8dd6b3c52132", "language": "en", "original_url": "/docs/16/auth-pg-hba-conf.html"}], "sections": [], "signature": "", "attributes": {"method": "password", "inventory": "User-visible source authentication method", "configuration": "pg_hba.conf"}, "description": ["\u8981\u6c42\u5ba2\u6237\u7aef\u63d0\u4f9b\u672a\u7ecf\u52a0\u5bc6\u7684\u5bc6\u7801\u8fdb\u884c\u8ba4\u8bc1\u3002\u7531\u4e8e\u5bc6\u7801\u901a\u8fc7\u7f51\u7edc\u660e\u6587\u4f20\u8f93\uff0c\u4e0d\u5e94\u5728\u4e0d\u53ef\u4fe1\u7f51\u7edc\u4e0a\u4f7f\u7528\u3002\u8be6\u60c5\u53c2\u89c1\u7b2c 21.5 \u8282\u3002"], "manual_html": "<div class=\"sect1\" id=\"AUTH-PASSWORD\">\n<div class=\"titlepage\">\n<div>\n<div>\n<h2 class=\"title\" lang=\"zh\">\n<div>\n<div>\n<h2 class=\"title\" style=\"clear: both\">21.5.\u00a0\u5bc6\u7801\u8ba4\u8bc1 </h2>\n</div>\n</div>\n</h2>\n</div>\n</div>\n</div>\n<p lang=\"zh\">\u6709\u51e0\u79cd\u57fa\u4e8e\u5bc6\u7801\u7684\u8ba4\u8bc1\u65b9\u6cd5\u3002\u8fd9\u4e9b\u65b9\u6cd5\u7684\u8fc7\u7a0b\u7c7b\u4f3c\uff0c\u4f46\u662f\u533a\u522b\u5728\u4e8e\u7528\u6237\u5bc6\u7801\u5982\u4f55\u5b58\u653e\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u53ca\u5ba2\u6237\u7aef\u63d0\u4f9b\u7684\u5bc6\u7801\u5982\u4f55\u901a\u8fc7\u8fde\u63a5\u53d1\u9001\u3002</p>\n<div class=\"variablelist\">\n<dl class=\"variablelist\">\n<dt><span class=\"term\"><code class=\"literal\">scram-sha-256</code></span></dt>\n<dd>\n<p lang=\"zh\"><code class=\"literal\">scram-sha-256</code> \u65b9\u6cd5\u6267\u884c SCRAM-SHA-256 \u8ba4\u8bc1\uff0c\u5176\u5b9a\u4e49\u89c1 <a class=\"ulink\" href=\"https://datatracker.ietf.org/doc/html/rfc7677\" target=\"_top\">RFC 7677</a>\u3002\u5b83\u662f\u4e00\u79cd\u6311\u6218-\u54cd\u5e94\u65b9\u6848\uff0c\u53ef\u9632\u6b62\u5728\u4e0d\u53d7\u4fe1\u4efb\u8fde\u63a5\u4e0a\u55c5\u63a2\u5bc6\u7801\uff0c\u5e76\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u88ab\u8ba4\u4e3a\u5b89\u5168\u7684\u5bc6\u7801\u5b66 hash \u5f62\u5f0f\u5b58\u50a8\u5bc6\u7801\u3002</p>\n<p lang=\"zh\">\u8fd9\u662f\u5f53\u524d\u63d0\u4f9b\u7684\u65b9\u6cd5\u4e2d\u6700\u5b89\u5168\u7684\u4e00\u79cd\uff0c\u4f46\u662f\u65e7\u7684\u5ba2\u6237\u7aef\u5e93\u4e0d\u652f\u6301\u8fd9\u79cd\u65b9\u6cd5\u3002</p>\n</dd>\n<dt><span class=\"term\"><code class=\"literal\">md5</code></span></dt>\n<dd>\n<p lang=\"zh\">\u65b9\u6cd5<code class=\"literal\">md5</code>\u4f7f\u7528\u4e00\u79cd\u81ea\u5b9a\u4e49\u7684\u3001\u5b89\u5168\u6027\u8f83\u4f4e\u7684\u6311\u6218-\u54cd\u5e94\u673a\u5236\u3002\u5b83\u80fd\u9632\u6b62\u5bc6\u7801\u55c5\u63a2\uff0c\u5e76\u907f\u514d\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u660e\u6587\u5b58\u50a8\u5bc6\u7801\uff1b\u4f46\u5982\u679c\u653b\u51fb\u8005\u8bbe\u6cd5\u4ece\u670d\u52a1\u5668\u4e0a\u7a83\u53d6\u4e86\u5bc6\u7801 hash\uff0c\u5b83\u5c31\u65e0\u6cd5\u63d0\u4f9b\u4fdd\u62a4\u3002\u6b64\u5916\uff0c\u5982\u4eca\u5df2\u4e0d\u518d\u8ba4\u4e3a MD5 hash \u7b97\u6cd5\u80fd\u62b5\u5fa1\u6709\u51b3\u5fc3\u7684\u653b\u51fb\u8005\u3002</p>\n<p lang=\"zh\"><code class=\"literal\">md5</code>\u65b9\u6cd5\u4e0d\u80fd\u4e0e<a class=\"xref\" href=\"/docs/16/runtime-config-connection.html#GUC-DB-USER-NAMESPACE\">db_user_namespace</a>\u529f\u80fd\u4e00\u8d77\u4f7f\u7528\u3002</p>\n<p lang=\"zh\">\u4e3a\u4fbf\u4e8e\u4ece md5 \u8fc1\u79fb\u5230\u8f83\u65b0\u7684 SCRAM \u65b9\u6cd5\uff0c\u5982\u679c pg_hba.conf \u4e2d\u6307\u5b9a md5\uff0c\u4f46\u670d\u52a1\u5668\u4e0a\u8be5\u7528\u6237\u7684\u5bc6\u7801\u91c7\u7528 SCRAM \u52a0\u5bc6\u5b58\u50a8\uff08\u89c1\u4e0b\u6587\uff09\uff0c\u7cfb\u7edf\u4f1a\u81ea\u52a8\u6539\u7528\u57fa\u4e8e SCRAM \u7684\u8ba4\u8bc1\u3002</p>\n</dd>\n<dt><span class=\"term\"><code class=\"literal\">password</code></span></dt>\n<dd>\n<p lang=\"zh\">\n<p>\u65b9\u6cd5<code class=\"literal\">password</code>\u4ee5\u660e\u6587\u5f62\u5f0f\u53d1\u9001\u5bc6\u7801\uff0c\u56e0\u6b64\u5b83\u5bb9\u6613\u53d7\u5230\u5bc6\u7801<span class=\"quote\">\u201c<span class=\"quote\">\u55c5\u63a2</span>\u201d</span>\u653b\u51fb\u3002\u5982\u679c\u53ef\u80fd\u5e94\u8be5\u5c3d\u91cf\u907f\u514d\u4f7f\u7528\u5b83\u3002\u4e0d\u8fc7\uff0c\u5982\u679c\u8fde\u63a5\u88abSSL\u52a0\u5bc6\u4fdd\u62a4\u7740\uff0c\u90a3\u4e48\u53ef\u4ee5\u5b89\u5168\u5730\u4f7f\u7528<code class=\"literal\">password</code>\uff08\u4e0d\u8fc7\u5982\u679c\u4f9d\u9760SSL\uff0cSSL\u8bc1\u4e66\u8ba4\u8bc1\u53ef\u80fd\u662f\u66f4\u597d\u7684\u9009\u62e9\uff09\u3002</p>\n</p>\n</dd>\n</dl>\n</div>\n<p lang=\"zh\"><span class=\"productname\">PostgreSQL</span> \u6570\u636e\u5e93\u5bc6\u7801\u72ec\u7acb\u4e8e\u64cd\u4f5c\u7cfb\u7edf\u7528\u6237\u5bc6\u7801\u3002\u6bcf\u4e2a\u6570\u636e\u5e93\u7528\u6237\u7684\u5bc6\u7801\u90fd\u5b58\u50a8\u5728\u7cfb\u7edf\u76ee\u5f55 <code class=\"literal\">pg_authid</code> \u4e2d\u3002\u5bc6\u7801\u53ef\u4ee5\u901a\u8fc7 SQL \u547d\u4ee4<a class=\"xref\" href=\"/docs/16/sql-createrole.html\" title=\"CREATE ROLE\"><span class=\"refentrytitle\">CREATE ROLE</span></a>\u548c<a class=\"xref\" href=\"/docs/16/sql-alterrole.html\" title=\"ALTER ROLE\"><span class=\"refentrytitle\">ALTER ROLE</span></a>\u7ba1\u7406\uff0c\u4f8b\u5982 <strong class=\"userinput\"><code>CREATE ROLE foo WITH LOGIN PASSWORD 'secret'</code></strong>\uff0c\u6216\u8005\u901a\u8fc7 <span class=\"application\">psql</span> \u7684 <code class=\"literal\">\\password</code> \u547d\u4ee4\u7ba1\u7406\u3002\u5982\u679c\u67d0\u4e2a\u7528\u6237\u6ca1\u6709\u8bbe\u7f6e\u5bc6\u7801\uff0c\u5219\u5176\u5b58\u50a8\u5bc6\u7801\u4e3a null\uff0c\u8be5\u7528\u6237\u7684\u5bc6\u7801\u8ba4\u8bc1\u5c06\u59cb\u7ec8\u5931\u8d25\u3002</p>\n<p lang=\"zh\">\u4e0d\u540c\u57fa\u4e8e\u5bc6\u7801\u7684\u8ba4\u8bc1\u65b9\u6cd5\u662f\u5426\u53ef\u7528\uff0c\u53d6\u51b3\u4e8e\u7528\u6237\u5728\u670d\u52a1\u5668\u4e0a\u7684\u5bc6\u7801\u662f\u5982\u4f55\u52a0\u5bc6\u7684\uff08\u66f4\u51c6\u786e\u5730\u8bf4\uff0c\u662f\u5982\u4f55\u8fdb\u884c hash \u8fd0\u7b97\u7684\uff09\u3002\u8fd9\u7531\u8bbe\u7f6e\u5bc6\u7801\u65f6\u7684\u914d\u7f6e\u53c2\u6570<a class=\"xref\" href=\"/docs/16/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION\">password_encryption</a>\u63a7\u5236\u3002\u5982\u679c\u5bc6\u7801\u662f\u4f7f\u7528 <code class=\"literal\">scram-sha-256</code> \u8bbe\u7f6e\u52a0\u5bc6\u7684\uff0c\u90a3\u4e48\u5b83\u53ef\u4ee5\u7528\u4e8e <code class=\"literal\">scram-sha-256</code> \u548c <code class=\"literal\">password</code> \u8ba4\u8bc1\u65b9\u6cd5\uff08\u4f46\u540e\u4e00\u79cd\u60c5\u51b5\u4e0b\u5bc6\u7801\u4f1a\u4ee5\u660e\u6587\u4f20\u8f93\uff09\u3002\u5982\u4e0a\u6240\u8ff0\uff0c\u6b64\u65f6\u5982\u679c\u8ba4\u8bc1\u65b9\u6cd5\u6307\u5b9a\u4e3a <code class=\"literal\">md5</code>\uff0c\u4e5f\u4f1a\u81ea\u52a8\u5207\u6362\u4e3a\u4f7f\u7528 <code class=\"literal\">scram-sha-256</code>\uff0c\u56e0\u6b64\u540c\u6837\u80fd\u591f\u5de5\u4f5c\u3002\u5982\u679c\u5bc6\u7801\u662f\u4f7f\u7528 <code class=\"literal\">md5</code> \u8bbe\u7f6e\u52a0\u5bc6\u7684\uff0c\u90a3\u4e48\u5b83\u53ea\u80fd\u7528\u4e8e <code class=\"literal\">md5</code> \u548c <code class=\"literal\">password</code> \u8ba4\u8bc1\u65b9\u6cd5\uff08\u540c\u6837\uff0c\u540e\u4e00\u79cd\u60c5\u51b5\u4e0b\u5bc6\u7801\u4f1a\u4ee5\u660e\u6587\u4f20\u8f93\uff09\u3002\uff08\u4ee5\u524d\u7684 PostgreSQL \u7248\u672c\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u5b58\u50a8\u660e\u6587\u5bc6\u7801\uff0c\u4f46\u73b0\u5728\u5df2\u7ecf\u4e0d\u518d\u53ef\u80fd\u3002\uff09\u8981\u68c0\u67e5\u5f53\u524d\u5b58\u50a8\u7684\u5bc6\u7801 hash\uff0c\u53ef\u4ee5\u67e5\u770b\u7cfb\u7edf\u76ee\u5f55 <code class=\"literal\">pg_authid</code>\u3002</p>\n<p lang=\"zh\">\u8981\u5c06\u73b0\u6709\u5b89\u88c5\u4ece md5 \u5347\u7ea7\u5230 scram-sha-256\uff0c\u5e94\u5148\u786e\u8ba4\u6240\u6709\u4f7f\u7528\u4e2d\u7684\u5ba2\u6237\u7aef\u5e93\u7248\u672c\u90fd\u652f\u6301 SCRAM\uff1b\u7136\u540e\u5728 postgresql.conf \u4e2d\u8bbe\u7f6e password_encryption = 'scram-sha-256'\uff0c\u8ba9\u6240\u6709\u7528\u6237\u91cd\u65b0\u8bbe\u7f6e\u5bc6\u7801\uff0c\u5e76\u5c06 pg_hba.conf \u4e2d\u7684\u8ba4\u8bc1\u65b9\u6cd5\u6539\u4e3a scram-sha-256\u3002</p>\n</div>", "manual_path": "/docs/16/auth-password.html", "localization": {"status": "complete", "sources": [{"url": "/docs/16/auth-password.html", "method": "same-major semantic node", "sha256": "c319a3ca0103170741767cd9fc7a1ff870c4db01ad67119bb5758353c1ace349", "language": "zh", "matched_nodes": ["#AUTH-PASSWORD/div[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]/p[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]/p[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[3]/p[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[3]/p[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[5]", "#AUTH-PASSWORD/p[4]", "#AUTH-PASSWORD/p[6]", "#AUTH-PASSWORD/p[7]"]}], "language": "zh", "original_text": {"/versions/16/description/0": "Require the client to supply an unencrypted password for authentication. Since the password is sent in clear text over the network, this should not be used on untrusted networks. See Section 21.5 for details.", "/versions/16/facts/0/label": "Method", "/versions/16/facts/1/label": "Configuration", "/versions/16/facts/2/label": "Inventory", "/versions/16/facts/2/value": "User-visible source authentication method", "/versions/16/tables/0/title": "Documented method options and alternatives", "/versions/16/tables/0/columns/0/label": "Option or term", "/versions/16/tables/0/columns/1/label": "Meaning", "/versions/16/tables/0/rows/0/description": "The method scram-sha-256 performs SCRAM-SHA-256 authentication, as described in RFC 7677 . It is a challenge-response scheme that prevents password sniffing on untrusted connections and supports storing passwords on the server in a cryptographically hashed form that is thought to be secure. This is the most secure of the currently provided methods, but it is not supported by older client libraries.", "/versions/16/tables/0/rows/1/description": "The method md5 uses a custom less secure challenge-response mechanism. It prevents password sniffing and avoids storing passwords on the server in plain text but provides no protection if an attacker manages to steal the password hash from the server. Also, the MD5 hash algorithm is nowadays no longer considered secure against determined attacks. The md5 method cannot be used with the db_user_namespace feature. To ease transition from the md5 method to the newer SCRAM method, if md5 is specified as a method in pg_hba.conf but the user's password on the server is encrypted for SCRAM (see below), then SCRAM-based authentication will automatically be chosen instead.", "/versions/16/tables/0/rows/2/description": "The method password sends the password in clear-text and is therefore vulnerable to password \u201c sniffing \u201d attacks. It should always be avoided if possible. If the connection is protected by SSL encryption then password can be used safely, though. (Though SSL certificate authentication might be a better choice if one is depending on using SSL)."}, "fallback_fields": [], "source_language": "en", "original_snapshot_sha256": "8c3a007ceb63419a19f3fa17d57f60ae8893bf1de66bd56d9bcb313f6ec0a964"}, "comparison_data": {"method": "password", "documented_option_names": ["md5", "password", "scram-sha-256"]}, "comparison_hash": "d4a07ed4f297699ecd061181bcc656e57ea443c94b1d7536a172c08865099daf", "manual_language": "zh"}, "17": {"facts": [{"label": "\u65b9\u6cd5", "value": "password"}, {"label": "\u914d\u7f6e", "value": "pg_hba.conf"}, {"label": "\u6e05\u5355", "value": "\u7528\u6237\u53ef\u89c1\u7684\u6e90\u7801\u8ba4\u8bc1\u65b9\u6cd5"}], "tables": [{"key": "method-options", "rows": [{"name": "scram-sha-256", "description": "scram-sha-256 \u65b9\u6cd5\u6267\u884c SCRAM-SHA-256 \u8ba4\u8bc1\uff0c\u5176\u5b9a\u4e49\u89c1 RFC 7677 \u3002\u5b83\u662f\u4e00\u79cd\u6311\u6218-\u54cd\u5e94\u65b9\u6848\uff0c\u53ef\u9632\u6b62\u5728\u4e0d\u53d7\u4fe1\u4efb\u8fde\u63a5\u4e0a\u55c5\u63a2\u5bc6\u7801\uff0c\u5e76\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u88ab\u8ba4\u4e3a\u5b89\u5168\u7684\u5bc6\u7801\u5b66 hash \u5f62\u5f0f\u5b58\u50a8\u5bc6\u7801\u3002 \u8fd9\u662f\u5f53\u524d\u63d0\u4f9b\u7684\u65b9\u6cd5\u4e2d\u6700\u5b89\u5168\u7684\u4e00\u79cd\uff0c\u4f46\u662f\u65e7\u7684\u5ba2\u6237\u7aef\u5e93\u4e0d\u652f\u6301\u8fd9\u79cd\u65b9\u6cd5\u3002"}, {"name": "md5", "description": "md5 \u65b9\u6cd5\u4f7f\u7528\u81ea\u5b9a\u4e49\u4e14\u5b89\u5168\u6027\u8f83\u5f31\u7684\u6311\u6218\u54cd\u5e94\u673a\u5236\u3002\u5b83\u80fd\u9632\u6b62\u5bc6\u7801\u55c5\u63a2\uff0c\u907f\u514d\u670d\u52a1\u5668\u660e\u6587\u5b58\u50a8\u5bc6\u7801\uff1b\u4f46\u653b\u51fb\u8005\u4e00\u65e6\u7a83\u53d6\u670d\u52a1\u5668\u4e0a\u7684\u5bc6\u7801\u54c8\u5e0c\uff0c\u5c31\u65e0\u6cd5\u63d0\u4f9b\u4fdd\u62a4\u3002\u6b64\u5916\uff0cMD5 \u54c8\u5e0c\u7b97\u6cd5\u5982\u4eca\u5df2\u4e0d\u518d\u88ab\u8ba4\u4e3a\u80fd\u5b89\u5168\u62b5\u5fa1\u6709\u9488\u5bf9\u6027\u7684\u653b\u51fb\u3002\u4e3a\u4fbf\u4e8e\u4ece md5 \u8fc1\u79fb\u5230\u8f83\u65b0\u7684 SCRAM \u65b9\u6cd5\uff0c\u5982\u679c pg_hba.conf \u4e2d\u6307\u5b9a md5\uff0c\u4f46\u670d\u52a1\u5668\u4e0a\u8be5\u7528\u6237\u7684\u5bc6\u7801\u91c7\u7528 SCRAM \u52a0\u5bc6\u5b58\u50a8\uff08\u89c1\u4e0b\u6587\uff09\uff0c\u7cfb\u7edf\u4f1a\u81ea\u52a8\u6539\u7528\u57fa\u4e8e SCRAM \u7684\u8ba4\u8bc1\u3002"}, {"name": "password", "description": "\u65b9\u6cd5 password \u4ee5\u660e\u6587\u5f62\u5f0f\u53d1\u9001\u5bc6\u7801\uff0c\u56e0\u6b64\u5b83\u5bb9\u6613\u53d7\u5230\u5bc6\u7801 \u201c \u55c5\u63a2 \u201d \u653b\u51fb\u3002\u5982\u679c\u53ef\u80fd\u5e94\u8be5\u5c3d\u91cf\u907f\u514d\u4f7f\u7528\u5b83\u3002\u4e0d\u8fc7\uff0c\u5982\u679c\u8fde\u63a5\u88abSSL\u52a0\u5bc6\u4fdd\u62a4\u7740\uff0c\u90a3\u4e48\u53ef\u4ee5\u5b89\u5168\u5730\u4f7f\u7528 password \uff08\u4e0d\u8fc7\u5982\u679c\u4f9d\u9760SSL\uff0cSSL\u8bc1\u4e66\u8ba4\u8bc1\u53ef\u80fd\u662f\u66f4\u597d\u7684\u9009\u62e9\uff09\u3002"}], "title": "\u624b\u518c\u4e2d\u7684\u65b9\u6cd5\u9009\u9879\u4e0e\u66ff\u4ee3\u65b9\u5f0f", "columns": [{"key": "name", "label": "\u9009\u9879\u6216\u672f\u8bed"}, {"key": "description", "label": "\u542b\u4e49"}]}], "aliases": [], "related": [], "release": {"ref": "https://ftp.postgresql.org/pub/source/v17.11/postgresql-17.11.tar.bz2", "label": "17.11", "major": "17", "channel": "stable", "revision": "dd27f2b3c59e73ed14aa3324901242bf69a032a6347805f274e6260322d42979", "source_sha256": "dd27f2b3c59e73ed14aa3324901242bf69a032a6347805f274e6260322d42979", "catalog_fingerprint": "4bbe3ac77becd618478f66aec420a533e9017be356c5c1d51a4b17f0fd497c07"}, "sources": [{"url": "https://ftp.postgresql.org/pub/source/v17.11/postgresql-17.11.tar.bz2", "label": "Matching PostgreSQL source archive", "sha256": "dd27f2b3c59e73ed14aa3324901242bf69a032a6347805f274e6260322d42979"}, {"url": "https://pg.center/docs/17/auth-password.html", "path": "auth-password.html", "label": "PostgreSQL 17 English manual", "sha256": "8c8ce306f8374b07ecb4ff1437de39d401e20243db1dacd3ac898d5478e530a1", "language": "en", "original_url": "/docs/17/auth-password.html"}, {"url": "https://pg.center/docs/17/auth-pg-hba-conf.html", "path": "auth-pg-hba-conf.html", "label": "PostgreSQL 17 English manual", "sha256": "00c7a7c25d46aa1b2f24cd744cd4990ca4218cfafed2a4cab8c1dc1092090bba", "language": "en", "original_url": "/docs/17/auth-pg-hba-conf.html"}], "sections": [], "signature": "", "attributes": {"method": "password", "inventory": "User-visible source authentication method", "configuration": "pg_hba.conf"}, "description": ["\u8981\u6c42\u5ba2\u6237\u7aef\u63d0\u4f9b\u672a\u7ecf\u52a0\u5bc6\u7684\u5bc6\u7801\u8fdb\u884c\u8ba4\u8bc1\u3002\u7531\u4e8e\u5bc6\u7801\u901a\u8fc7\u7f51\u7edc\u660e\u6587\u4f20\u8f93\uff0c\u4e0d\u5e94\u5728\u4e0d\u53ef\u4fe1\u7f51\u7edc\u4e0a\u4f7f\u7528\u3002\u8be6\u60c5\u53c2\u89c1\u7b2c 20.5 \u8282\u3002"], "manual_html": "<div class=\"sect1\" id=\"AUTH-PASSWORD\">\n<div class=\"titlepage\">\n<div>\n<div>\n<h2 class=\"title\" lang=\"zh\">\n<div>\n<div>\n<h2 class=\"title\" style=\"clear: both\">20.5.\u00a0\u5bc6\u7801\u8ba4\u8bc1 </h2>\n</div>\n</div>\n</h2>\n</div>\n</div>\n</div>\n<p lang=\"zh\">\u6709\u51e0\u79cd\u57fa\u4e8e\u5bc6\u7801\u7684\u8ba4\u8bc1\u65b9\u6cd5\u3002\u8fd9\u4e9b\u65b9\u6cd5\u7684\u8fc7\u7a0b\u7c7b\u4f3c\uff0c\u4f46\u662f\u533a\u522b\u5728\u4e8e\u7528\u6237\u5bc6\u7801\u5982\u4f55\u5b58\u653e\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u53ca\u5ba2\u6237\u7aef\u63d0\u4f9b\u7684\u5bc6\u7801\u5982\u4f55\u901a\u8fc7\u8fde\u63a5\u53d1\u9001\u3002</p>\n<div class=\"variablelist\">\n<dl class=\"variablelist\">\n<dt><span class=\"term\"><code class=\"literal\">scram-sha-256</code></span></dt>\n<dd>\n<p lang=\"zh\"><code class=\"literal\">scram-sha-256</code> \u65b9\u6cd5\u6267\u884c SCRAM-SHA-256 \u8ba4\u8bc1\uff0c\u5176\u5b9a\u4e49\u89c1 <a class=\"ulink\" href=\"https://datatracker.ietf.org/doc/html/rfc7677\" target=\"_top\">RFC 7677</a>\u3002\u5b83\u662f\u4e00\u79cd\u6311\u6218-\u54cd\u5e94\u65b9\u6848\uff0c\u53ef\u9632\u6b62\u5728\u4e0d\u53d7\u4fe1\u4efb\u8fde\u63a5\u4e0a\u55c5\u63a2\u5bc6\u7801\uff0c\u5e76\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u88ab\u8ba4\u4e3a\u5b89\u5168\u7684\u5bc6\u7801\u5b66 hash \u5f62\u5f0f\u5b58\u50a8\u5bc6\u7801\u3002</p>\n<p lang=\"zh\">\u8fd9\u662f\u5f53\u524d\u63d0\u4f9b\u7684\u65b9\u6cd5\u4e2d\u6700\u5b89\u5168\u7684\u4e00\u79cd\uff0c\u4f46\u662f\u65e7\u7684\u5ba2\u6237\u7aef\u5e93\u4e0d\u652f\u6301\u8fd9\u79cd\u65b9\u6cd5\u3002</p>\n</dd>\n<dt><span class=\"term\"><code class=\"literal\">md5</code></span></dt>\n<dd>\n<p lang=\"zh\">\u65b9\u6cd5<code class=\"literal\">md5</code>\u4f7f\u7528\u4e00\u79cd\u81ea\u5b9a\u4e49\u7684\u3001\u5b89\u5168\u6027\u8f83\u4f4e\u7684\u6311\u6218-\u54cd\u5e94\u673a\u5236\u3002\u5b83\u80fd\u9632\u6b62\u5bc6\u7801\u55c5\u63a2\uff0c\u5e76\u907f\u514d\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u660e\u6587\u5b58\u50a8\u5bc6\u7801\uff1b\u4f46\u5982\u679c\u653b\u51fb\u8005\u8bbe\u6cd5\u4ece\u670d\u52a1\u5668\u4e0a\u7a83\u53d6\u4e86\u5bc6\u7801 hash\uff0c\u5b83\u5c31\u65e0\u6cd5\u63d0\u4f9b\u4fdd\u62a4\u3002\u6b64\u5916\uff0c\u5982\u4eca\u5df2\u4e0d\u518d\u8ba4\u4e3a MD5 hash \u7b97\u6cd5\u80fd\u62b5\u5fa1\u6709\u51b3\u5fc3\u7684\u653b\u51fb\u8005\u3002</p>\n<p lang=\"zh\">\u4e3a\u4fbf\u4e8e\u4ece md5 \u8fc1\u79fb\u5230\u8f83\u65b0\u7684 SCRAM \u65b9\u6cd5\uff0c\u5982\u679c pg_hba.conf \u4e2d\u6307\u5b9a md5\uff0c\u4f46\u670d\u52a1\u5668\u4e0a\u8be5\u7528\u6237\u7684\u5bc6\u7801\u91c7\u7528 SCRAM \u52a0\u5bc6\u5b58\u50a8\uff08\u89c1\u4e0b\u6587\uff09\uff0c\u7cfb\u7edf\u4f1a\u81ea\u52a8\u6539\u7528\u57fa\u4e8e SCRAM \u7684\u8ba4\u8bc1\u3002</p>\n</dd>\n<dt><span class=\"term\"><code class=\"literal\">password</code></span></dt>\n<dd>\n<p lang=\"zh\">\n<p>\u65b9\u6cd5<code class=\"literal\">password</code>\u4ee5\u660e\u6587\u5f62\u5f0f\u53d1\u9001\u5bc6\u7801\uff0c\u56e0\u6b64\u5b83\u5bb9\u6613\u53d7\u5230\u5bc6\u7801<span class=\"quote\">\u201c<span class=\"quote\">\u55c5\u63a2</span>\u201d</span>\u653b\u51fb\u3002\u5982\u679c\u53ef\u80fd\u5e94\u8be5\u5c3d\u91cf\u907f\u514d\u4f7f\u7528\u5b83\u3002\u4e0d\u8fc7\uff0c\u5982\u679c\u8fde\u63a5\u88abSSL\u52a0\u5bc6\u4fdd\u62a4\u7740\uff0c\u90a3\u4e48\u53ef\u4ee5\u5b89\u5168\u5730\u4f7f\u7528<code class=\"literal\">password</code>\uff08\u4e0d\u8fc7\u5982\u679c\u4f9d\u9760SSL\uff0cSSL\u8bc1\u4e66\u8ba4\u8bc1\u53ef\u80fd\u662f\u66f4\u597d\u7684\u9009\u62e9\uff09\u3002</p>\n</p>\n</dd>\n</dl>\n</div>\n<p lang=\"zh\"><span class=\"productname\">PostgreSQL</span> \u6570\u636e\u5e93\u5bc6\u7801\u72ec\u7acb\u4e8e\u64cd\u4f5c\u7cfb\u7edf\u7528\u6237\u5bc6\u7801\u3002\u6bcf\u4e2a\u6570\u636e\u5e93\u7528\u6237\u7684\u5bc6\u7801\u90fd\u5b58\u50a8\u5728\u7cfb\u7edf\u76ee\u5f55 <code class=\"literal\">pg_authid</code> \u4e2d\u3002\u5bc6\u7801\u53ef\u4ee5\u901a\u8fc7 SQL \u547d\u4ee4<a class=\"xref\" href=\"/docs/17/sql-createrole.html\" title=\"CREATE ROLE\"><span class=\"refentrytitle\">CREATE ROLE</span></a>\u548c<a class=\"xref\" href=\"/docs/17/sql-alterrole.html\" title=\"ALTER ROLE\"><span class=\"refentrytitle\">ALTER ROLE</span></a>\u7ba1\u7406\uff0c\u4f8b\u5982 <strong class=\"userinput\"><code>CREATE ROLE foo WITH LOGIN PASSWORD 'secret'</code></strong>\uff0c\u6216\u8005\u901a\u8fc7 <span class=\"application\">psql</span> \u7684 <code class=\"literal\">\\password</code> \u547d\u4ee4\u7ba1\u7406\u3002\u5982\u679c\u67d0\u4e2a\u7528\u6237\u6ca1\u6709\u8bbe\u7f6e\u5bc6\u7801\uff0c\u5219\u5176\u5b58\u50a8\u5bc6\u7801\u4e3a null\uff0c\u8be5\u7528\u6237\u7684\u5bc6\u7801\u8ba4\u8bc1\u5c06\u59cb\u7ec8\u5931\u8d25\u3002</p>\n<p lang=\"zh\">\u4e0d\u540c\u57fa\u4e8e\u5bc6\u7801\u7684\u8ba4\u8bc1\u65b9\u6cd5\u662f\u5426\u53ef\u7528\uff0c\u53d6\u51b3\u4e8e\u7528\u6237\u5728\u670d\u52a1\u5668\u4e0a\u7684\u5bc6\u7801\u662f\u5982\u4f55\u52a0\u5bc6\u7684\uff08\u66f4\u51c6\u786e\u5730\u8bf4\uff0c\u662f\u5982\u4f55\u8fdb\u884c hash \u8fd0\u7b97\u7684\uff09\u3002\u8fd9\u7531\u8bbe\u7f6e\u5bc6\u7801\u65f6\u7684\u914d\u7f6e\u53c2\u6570<a class=\"xref\" href=\"/docs/17/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION\">password_encryption</a>\u63a7\u5236\u3002\u5982\u679c\u5bc6\u7801\u662f\u4f7f\u7528 <code class=\"literal\">scram-sha-256</code> \u8bbe\u7f6e\u52a0\u5bc6\u7684\uff0c\u90a3\u4e48\u5b83\u53ef\u4ee5\u7528\u4e8e <code class=\"literal\">scram-sha-256</code> \u548c <code class=\"literal\">password</code> \u8ba4\u8bc1\u65b9\u6cd5\uff08\u4f46\u540e\u4e00\u79cd\u60c5\u51b5\u4e0b\u5bc6\u7801\u4f1a\u4ee5\u660e\u6587\u4f20\u8f93\uff09\u3002\u5982\u4e0a\u6240\u8ff0\uff0c\u6b64\u65f6\u5982\u679c\u8ba4\u8bc1\u65b9\u6cd5\u6307\u5b9a\u4e3a <code class=\"literal\">md5</code>\uff0c\u4e5f\u4f1a\u81ea\u52a8\u5207\u6362\u4e3a\u4f7f\u7528 <code class=\"literal\">scram-sha-256</code>\uff0c\u56e0\u6b64\u540c\u6837\u80fd\u591f\u5de5\u4f5c\u3002\u5982\u679c\u5bc6\u7801\u662f\u4f7f\u7528 <code class=\"literal\">md5</code> \u8bbe\u7f6e\u52a0\u5bc6\u7684\uff0c\u90a3\u4e48\u5b83\u53ea\u80fd\u7528\u4e8e <code class=\"literal\">md5</code> \u548c <code class=\"literal\">password</code> \u8ba4\u8bc1\u65b9\u6cd5\uff08\u540c\u6837\uff0c\u540e\u4e00\u79cd\u60c5\u51b5\u4e0b\u5bc6\u7801\u4f1a\u4ee5\u660e\u6587\u4f20\u8f93\uff09\u3002\uff08\u4ee5\u524d\u7684 PostgreSQL \u7248\u672c\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u5b58\u50a8\u660e\u6587\u5bc6\u7801\uff0c\u4f46\u73b0\u5728\u5df2\u7ecf\u4e0d\u518d\u53ef\u80fd\u3002\uff09\u8981\u68c0\u67e5\u5f53\u524d\u5b58\u50a8\u7684\u5bc6\u7801 hash\uff0c\u53ef\u4ee5\u67e5\u770b\u7cfb\u7edf\u76ee\u5f55 <code class=\"literal\">pg_authid</code>\u3002</p>\n<p lang=\"zh\">\u8981\u5c06\u73b0\u6709\u5b89\u88c5\u4ece md5 \u5347\u7ea7\u5230 scram-sha-256\uff0c\u5e94\u5148\u786e\u8ba4\u6240\u6709\u4f7f\u7528\u4e2d\u7684\u5ba2\u6237\u7aef\u5e93\u7248\u672c\u90fd\u652f\u6301 SCRAM\uff1b\u7136\u540e\u5728 postgresql.conf \u4e2d\u8bbe\u7f6e password_encryption = 'scram-sha-256'\uff0c\u8ba9\u6240\u6709\u7528\u6237\u91cd\u65b0\u8bbe\u7f6e\u5bc6\u7801\uff0c\u5e76\u5c06 pg_hba.conf \u4e2d\u7684\u8ba4\u8bc1\u65b9\u6cd5\u6539\u4e3a scram-sha-256\u3002</p>\n</div>", "manual_path": "/docs/17/auth-password.html", "localization": {"status": "complete", "sources": [{"url": "/docs/17/auth-password.html", "method": "same-major semantic node", "sha256": "2bc3681f0f3117bcb93813f098e473dd5aa1a46ef4c8dc10516a3015651dc6b0", "language": "zh", "matched_nodes": ["#AUTH-PASSWORD/div[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]/p[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]/p[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[3]/p[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[5]", "#AUTH-PASSWORD/p[4]", "#AUTH-PASSWORD/p[6]", "#AUTH-PASSWORD/p[7]"]}], "language": "zh", "original_text": {"/versions/17/description/0": "Require the client to supply an unencrypted password for authentication. Since the password is sent in clear text over the network, this should not be used on untrusted networks. See Section 20.5 for details.", "/versions/17/facts/0/label": "Method", "/versions/17/facts/1/label": "Configuration", "/versions/17/facts/2/label": "Inventory", "/versions/17/facts/2/value": "User-visible source authentication method", "/versions/17/tables/0/title": "Documented method options and alternatives", "/versions/17/tables/0/columns/0/label": "Option or term", "/versions/17/tables/0/columns/1/label": "Meaning", "/versions/17/tables/0/rows/0/description": "The method scram-sha-256 performs SCRAM-SHA-256 authentication, as described in RFC 7677 . It is a challenge-response scheme that prevents password sniffing on untrusted connections and supports storing passwords on the server in a cryptographically hashed form that is thought to be secure. This is the most secure of the currently provided methods, but it is not supported by older client libraries.", "/versions/17/tables/0/rows/1/description": "The method md5 uses a custom less secure challenge-response mechanism. It prevents password sniffing and avoids storing passwords on the server in plain text but provides no protection if an attacker manages to steal the password hash from the server. Also, the MD5 hash algorithm is nowadays no longer considered secure against determined attacks. To ease transition from the md5 method to the newer SCRAM method, if md5 is specified as a method in pg_hba.conf but the user's password on the server is encrypted for SCRAM (see below), then SCRAM-based authentication will automatically be chosen instead.", "/versions/17/tables/0/rows/2/description": "The method password sends the password in clear-text and is therefore vulnerable to password \u201c sniffing \u201d attacks. It should always be avoided if possible. If the connection is protected by SSL encryption then password can be used safely, though. (Though SSL certificate authentication might be a better choice if one is depending on using SSL)."}, "fallback_fields": [], "source_language": "en", "original_snapshot_sha256": "ced22e7f56f19e37bcbb0c40154324336273286ecfd303a5c22574d65efe8382"}, "comparison_data": {"method": "password", "documented_option_names": ["md5", "password", "scram-sha-256"]}, "comparison_hash": "d4a07ed4f297699ecd061181bcc656e57ea443c94b1d7536a172c08865099daf", "manual_language": "zh"}, "18": {"facts": [{"label": "\u65b9\u6cd5", "value": "password"}, {"label": "\u914d\u7f6e", "value": "pg_hba.conf"}, {"label": "\u6e05\u5355", "value": "\u7528\u6237\u53ef\u89c1\u7684\u6e90\u7801\u8ba4\u8bc1\u65b9\u6cd5"}], "tables": [{"key": "method-options", "rows": [{"name": "scram-sha-256", "description": "scram-sha-256 \u65b9\u6cd5\u6267\u884c SCRAM-SHA-256 \u8ba4\u8bc1\uff0c\u5176\u5b9a\u4e49\u89c1 RFC 7677 \u3002\u5b83\u662f\u4e00\u79cd\u6311\u6218-\u54cd\u5e94\u65b9\u6848\uff0c\u53ef\u9632\u6b62\u5728\u4e0d\u53d7\u4fe1\u4efb\u8fde\u63a5\u4e0a\u55c5\u63a2\u5bc6\u7801\uff0c\u5e76\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u88ab\u8ba4\u4e3a\u5b89\u5168\u7684\u5bc6\u7801\u5b66 hash \u5f62\u5f0f\u5b58\u50a8\u5bc6\u7801\u3002 \u8fd9\u662f\u5f53\u524d\u63d0\u4f9b\u7684\u65b9\u6cd5\u4e2d\u6700\u5b89\u5168\u7684\u4e00\u79cd\uff0c\u4f46\u662f\u65e7\u7684\u5ba2\u6237\u7aef\u5e93\u4e0d\u652f\u6301\u8fd9\u79cd\u65b9\u6cd5\u3002"}, {"name": "md5", "description": "md5 \u65b9\u6cd5\u4f7f\u7528\u81ea\u5b9a\u4e49\u4e14\u5b89\u5168\u6027\u8f83\u5f31\u7684\u6311\u6218\u54cd\u5e94\u673a\u5236\u3002\u5b83\u80fd\u9632\u6b62\u5bc6\u7801\u55c5\u63a2\uff0c\u907f\u514d\u670d\u52a1\u5668\u660e\u6587\u5b58\u50a8\u5bc6\u7801\uff1b\u4f46\u653b\u51fb\u8005\u4e00\u65e6\u7a83\u53d6\u670d\u52a1\u5668\u4e0a\u7684\u5bc6\u7801\u54c8\u5e0c\uff0c\u5c31\u65e0\u6cd5\u63d0\u4f9b\u4fdd\u62a4\u3002\u6b64\u5916\uff0cMD5 \u54c8\u5e0c\u7b97\u6cd5\u5982\u4eca\u5df2\u4e0d\u518d\u88ab\u8ba4\u4e3a\u80fd\u5b89\u5168\u62b5\u5fa1\u6709\u9488\u5bf9\u6027\u7684\u653b\u51fb\u3002\u4e3a\u4fbf\u4e8e\u4ece md5 \u8fc1\u79fb\u5230\u8f83\u65b0\u7684 SCRAM \u65b9\u6cd5\uff0c\u5982\u679c pg_hba.conf \u4e2d\u6307\u5b9a md5\uff0c\u4f46\u670d\u52a1\u5668\u4e0a\u8be5\u7528\u6237\u7684\u5bc6\u7801\u91c7\u7528 SCRAM \u52a0\u5bc6\u5b58\u50a8\uff08\u89c1\u4e0b\u6587\uff09\uff0c\u7cfb\u7edf\u4f1a\u81ea\u52a8\u6539\u7528\u57fa\u4e8e SCRAM \u7684\u8ba4\u8bc1\u3002\u8b66\u544a\uff1a\u5bf9 MD5 \u52a0\u5bc6\u5bc6\u7801\u7684\u652f\u6301\u5df2\u5f03\u7528\uff0c\u5c06\u5728 PostgreSQL \u7684\u672a\u6765\u7248\u672c\u4e2d\u79fb\u9664\u3002\u8fc1\u79fb\u5230\u5176\u4ed6\u5bc6\u7801\u7c7b\u578b\u7684\u65b9\u6cd5\u53c2\u89c1\u4e0b\u6587\u3002"}, {"name": "password", "description": "\u65b9\u6cd5 password \u4ee5\u660e\u6587\u5f62\u5f0f\u53d1\u9001\u5bc6\u7801\uff0c\u56e0\u6b64\u5b83\u5bb9\u6613\u53d7\u5230\u5bc6\u7801 \u201c \u55c5\u63a2 \u201d \u653b\u51fb\u3002\u5982\u679c\u53ef\u80fd\u5e94\u8be5\u5c3d\u91cf\u907f\u514d\u4f7f\u7528\u5b83\u3002\u4e0d\u8fc7\uff0c\u5982\u679c\u8fde\u63a5\u88abSSL\u52a0\u5bc6\u4fdd\u62a4\u7740\uff0c\u90a3\u4e48\u53ef\u4ee5\u5b89\u5168\u5730\u4f7f\u7528 password \uff08\u4e0d\u8fc7\u5982\u679c\u4f9d\u9760SSL\uff0cSSL\u8bc1\u4e66\u8ba4\u8bc1\u53ef\u80fd\u662f\u66f4\u597d\u7684\u9009\u62e9\uff09\u3002"}], "title": "\u624b\u518c\u4e2d\u7684\u65b9\u6cd5\u9009\u9879\u4e0e\u66ff\u4ee3\u65b9\u5f0f", "columns": [{"key": "name", "label": "\u9009\u9879\u6216\u672f\u8bed"}, {"key": "description", "label": "\u542b\u4e49"}]}], "aliases": [], "related": [], "release": {"ref": "https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2", "label": "18.6", "major": "18", "channel": "stable", "revision": "555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f", "source_sha256": "555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f", "catalog_fingerprint": "65c93d6048ef30e61023a84f9680fa6a92b1c383b7eb226741170077eb078502"}, "sources": [{"url": "https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2", "label": "Matching PostgreSQL source archive", "sha256": "555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f"}, {"url": "https://pg.center/docs/18/auth-password.html", "path": "auth-password.html", "label": "PostgreSQL 18 English manual", "sha256": "89d87aa104ffde4d6ddb753032794cc5924db149179845d97788e0999e0971c1", "language": "en", "original_url": "/docs/18/auth-password.html"}, {"url": "https://pg.center/docs/18/auth-pg-hba-conf.html", "path": "auth-pg-hba-conf.html", "label": "PostgreSQL 18 English manual", "sha256": "6340d4abea2e0a3482afc31bcd1599a0fa10dc28a6f1e05d79ba831e2dd0b4c9", "language": "en", "original_url": "/docs/18/auth-pg-hba-conf.html"}], "sections": [], "signature": "", "attributes": {"method": "password", "inventory": "User-visible source authentication method", "configuration": "pg_hba.conf"}, "description": ["\u8981\u6c42\u5ba2\u6237\u7aef\u63d0\u4f9b\u672a\u7ecf\u52a0\u5bc6\u7684\u5bc6\u7801\u8fdb\u884c\u8ba4\u8bc1\u3002\u7531\u4e8e\u5bc6\u7801\u901a\u8fc7\u7f51\u7edc\u660e\u6587\u4f20\u8f93\uff0c\u4e0d\u5e94\u5728\u4e0d\u53ef\u4fe1\u7f51\u7edc\u4e0a\u4f7f\u7528\u3002\u8be6\u60c5\u53c2\u89c1\u7b2c 20.5 \u8282\u3002"], "manual_html": "<div class=\"sect1\" id=\"AUTH-PASSWORD\">\n<div class=\"titlepage\">\n<div>\n<div>\n<h2 class=\"title\" lang=\"zh\">\n<div>\n<div>\n<h2 class=\"title\" style=\"clear: both\">20.5.\u00a0\u5bc6\u7801\u8ba4\u8bc1 </h2>\n</div>\n</div>\n</h2>\n</div>\n</div>\n</div>\n<p lang=\"zh\">\u6709\u51e0\u79cd\u57fa\u4e8e\u5bc6\u7801\u7684\u8ba4\u8bc1\u65b9\u6cd5\u3002\u8fd9\u4e9b\u65b9\u6cd5\u7684\u8fc7\u7a0b\u7c7b\u4f3c\uff0c\u4f46\u662f\u533a\u522b\u5728\u4e8e\u7528\u6237\u5bc6\u7801\u5982\u4f55\u5b58\u653e\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u53ca\u5ba2\u6237\u7aef\u63d0\u4f9b\u7684\u5bc6\u7801\u5982\u4f55\u901a\u8fc7\u8fde\u63a5\u53d1\u9001\u3002</p>\n<div class=\"variablelist\">\n<dl class=\"variablelist\">\n<dt><span class=\"term\"><code class=\"literal\">scram-sha-256</code></span></dt>\n<dd>\n<p lang=\"zh\"><code class=\"literal\">scram-sha-256</code> \u65b9\u6cd5\u6267\u884c SCRAM-SHA-256 \u8ba4\u8bc1\uff0c\u5176\u5b9a\u4e49\u89c1 <a class=\"ulink\" href=\"https://datatracker.ietf.org/doc/html/rfc7677\" target=\"_top\">RFC 7677</a>\u3002\u5b83\u662f\u4e00\u79cd\u6311\u6218-\u54cd\u5e94\u65b9\u6848\uff0c\u53ef\u9632\u6b62\u5728\u4e0d\u53d7\u4fe1\u4efb\u8fde\u63a5\u4e0a\u55c5\u63a2\u5bc6\u7801\uff0c\u5e76\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u88ab\u8ba4\u4e3a\u5b89\u5168\u7684\u5bc6\u7801\u5b66 hash \u5f62\u5f0f\u5b58\u50a8\u5bc6\u7801\u3002</p>\n<p lang=\"zh\">\u8fd9\u662f\u5f53\u524d\u63d0\u4f9b\u7684\u65b9\u6cd5\u4e2d\u6700\u5b89\u5168\u7684\u4e00\u79cd\uff0c\u4f46\u662f\u65e7\u7684\u5ba2\u6237\u7aef\u5e93\u4e0d\u652f\u6301\u8fd9\u79cd\u65b9\u6cd5\u3002</p>\n</dd>\n<dt><span class=\"term\"><code class=\"literal\">md5</code></span></dt>\n<dd>\n<p lang=\"zh\">\u65b9\u6cd5<code class=\"literal\">md5</code>\u4f7f\u7528\u4e00\u79cd\u81ea\u5b9a\u4e49\u7684\u3001\u5b89\u5168\u6027\u8f83\u4f4e\u7684\u6311\u6218-\u54cd\u5e94\u673a\u5236\u3002\u5b83\u80fd\u9632\u6b62\u5bc6\u7801\u55c5\u63a2\uff0c\u5e76\u907f\u514d\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u660e\u6587\u5b58\u50a8\u5bc6\u7801\uff1b\u4f46\u5982\u679c\u653b\u51fb\u8005\u8bbe\u6cd5\u4ece\u670d\u52a1\u5668\u4e0a\u7a83\u53d6\u4e86\u5bc6\u7801 hash\uff0c\u5b83\u5c31\u65e0\u6cd5\u63d0\u4f9b\u4fdd\u62a4\u3002\u6b64\u5916\uff0c\u5982\u4eca\u5df2\u4e0d\u518d\u8ba4\u4e3a MD5 hash \u7b97\u6cd5\u80fd\u62b5\u5fa1\u6709\u51b3\u5fc3\u7684\u653b\u51fb\u8005\u3002</p>\n<p lang=\"zh\">\u4e3a\u4fbf\u4e8e\u4ece md5 \u8fc1\u79fb\u5230\u8f83\u65b0\u7684 SCRAM \u65b9\u6cd5\uff0c\u5982\u679c pg_hba.conf \u4e2d\u6307\u5b9a md5\uff0c\u4f46\u670d\u52a1\u5668\u4e0a\u8be5\u7528\u6237\u7684\u5bc6\u7801\u91c7\u7528 SCRAM \u52a0\u5bc6\u5b58\u50a8\uff08\u89c1\u4e0b\u6587\uff09\uff0c\u7cfb\u7edf\u4f1a\u81ea\u52a8\u6539\u7528\u57fa\u4e8e SCRAM \u7684\u8ba4\u8bc1\u3002</p>\n<div class=\"warning\">\n<h3 class=\"title\" lang=\"zh\">\u8b66\u544a</h3>\n<p lang=\"zh\">\u5bf9 MD5 \u52a0\u5bc6\u5bc6\u7801\u7684\u652f\u6301\u5df2\u5f03\u7528\uff0c\u5e76\u5c06\u5728<span class=\"productname\">PostgreSQL</span>\u7684\u672a\u6765\u7248\u672c\u4e2d\u79fb\u9664\u3002\u8fc1\u79fb\u5230\u5176\u4ed6\u5bc6\u7801\u7c7b\u578b\u7684\u8be6\u7ec6\u4fe1\u606f\u89c1\u4e0b\u6587\u3002</p>\n</div>\n</dd>\n<dt><span class=\"term\"><code class=\"literal\">password</code></span></dt>\n<dd>\n<p lang=\"zh\">\n<p>\u65b9\u6cd5<code class=\"literal\">password</code>\u4ee5\u660e\u6587\u5f62\u5f0f\u53d1\u9001\u5bc6\u7801\uff0c\u56e0\u6b64\u5b83\u5bb9\u6613\u53d7\u5230\u5bc6\u7801<span class=\"quote\">\u201c<span class=\"quote\">\u55c5\u63a2</span>\u201d</span>\u653b\u51fb\u3002\u5982\u679c\u53ef\u80fd\u5e94\u8be5\u5c3d\u91cf\u907f\u514d\u4f7f\u7528\u5b83\u3002\u4e0d\u8fc7\uff0c\u5982\u679c\u8fde\u63a5\u88abSSL\u52a0\u5bc6\u4fdd\u62a4\u7740\uff0c\u90a3\u4e48\u53ef\u4ee5\u5b89\u5168\u5730\u4f7f\u7528<code class=\"literal\">password</code>\uff08\u4e0d\u8fc7\u5982\u679c\u4f9d\u9760SSL\uff0cSSL\u8bc1\u4e66\u8ba4\u8bc1\u53ef\u80fd\u662f\u66f4\u597d\u7684\u9009\u62e9\uff09\u3002</p>\n</p>\n</dd>\n</dl>\n</div>\n<p lang=\"zh\"><span class=\"productname\">PostgreSQL</span> \u6570\u636e\u5e93\u5bc6\u7801\u72ec\u7acb\u4e8e\u64cd\u4f5c\u7cfb\u7edf\u7528\u6237\u5bc6\u7801\u3002\u6bcf\u4e2a\u6570\u636e\u5e93\u7528\u6237\u7684\u5bc6\u7801\u90fd\u5b58\u50a8\u5728\u7cfb\u7edf\u76ee\u5f55 <code class=\"literal\">pg_authid</code> \u4e2d\u3002\u5bc6\u7801\u53ef\u4ee5\u901a\u8fc7 SQL \u547d\u4ee4<a class=\"xref\" href=\"/docs/18/sql-createrole.html\" title=\"CREATE ROLE\"><span class=\"refentrytitle\">CREATE ROLE</span></a>\u548c<a class=\"xref\" href=\"/docs/18/sql-alterrole.html\" title=\"ALTER ROLE\"><span class=\"refentrytitle\">ALTER ROLE</span></a>\u7ba1\u7406\uff0c\u4f8b\u5982 <strong class=\"userinput\"><code>CREATE ROLE foo WITH LOGIN PASSWORD 'secret'</code></strong>\uff0c\u6216\u8005\u901a\u8fc7 <span class=\"application\">psql</span> \u7684 <code class=\"literal\">\\password</code> \u547d\u4ee4\u7ba1\u7406\u3002\u5982\u679c\u67d0\u4e2a\u7528\u6237\u6ca1\u6709\u8bbe\u7f6e\u5bc6\u7801\uff0c\u5219\u5176\u5b58\u50a8\u5bc6\u7801\u4e3a null\uff0c\u8be5\u7528\u6237\u7684\u5bc6\u7801\u8ba4\u8bc1\u5c06\u59cb\u7ec8\u5931\u8d25\u3002</p>\n<p lang=\"zh\">\u4e0d\u540c\u57fa\u4e8e\u5bc6\u7801\u7684\u8ba4\u8bc1\u65b9\u6cd5\u662f\u5426\u53ef\u7528\uff0c\u53d6\u51b3\u4e8e\u7528\u6237\u5728\u670d\u52a1\u5668\u4e0a\u7684\u5bc6\u7801\u662f\u5982\u4f55\u52a0\u5bc6\u7684\uff08\u66f4\u51c6\u786e\u5730\u8bf4\uff0c\u662f\u5982\u4f55\u8fdb\u884c hash \u8fd0\u7b97\u7684\uff09\u3002\u8fd9\u7531\u8bbe\u7f6e\u5bc6\u7801\u65f6\u7684\u914d\u7f6e\u53c2\u6570<a class=\"xref\" href=\"/docs/18/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION\">password_encryption</a>\u63a7\u5236\u3002\u5982\u679c\u5bc6\u7801\u662f\u4f7f\u7528 <code class=\"literal\">scram-sha-256</code> \u8bbe\u7f6e\u52a0\u5bc6\u7684\uff0c\u90a3\u4e48\u5b83\u53ef\u4ee5\u7528\u4e8e <code class=\"literal\">scram-sha-256</code> \u548c <code class=\"literal\">password</code> \u8ba4\u8bc1\u65b9\u6cd5\uff08\u4f46\u540e\u4e00\u79cd\u60c5\u51b5\u4e0b\u5bc6\u7801\u4f1a\u4ee5\u660e\u6587\u4f20\u8f93\uff09\u3002\u5982\u4e0a\u6240\u8ff0\uff0c\u6b64\u65f6\u5982\u679c\u8ba4\u8bc1\u65b9\u6cd5\u6307\u5b9a\u4e3a <code class=\"literal\">md5</code>\uff0c\u4e5f\u4f1a\u81ea\u52a8\u5207\u6362\u4e3a\u4f7f\u7528 <code class=\"literal\">scram-sha-256</code>\uff0c\u56e0\u6b64\u540c\u6837\u80fd\u591f\u5de5\u4f5c\u3002\u5982\u679c\u5bc6\u7801\u662f\u4f7f\u7528 <code class=\"literal\">md5</code> \u8bbe\u7f6e\u52a0\u5bc6\u7684\uff0c\u90a3\u4e48\u5b83\u53ea\u80fd\u7528\u4e8e <code class=\"literal\">md5</code> \u548c <code class=\"literal\">password</code> \u8ba4\u8bc1\u65b9\u6cd5\uff08\u540c\u6837\uff0c\u540e\u4e00\u79cd\u60c5\u51b5\u4e0b\u5bc6\u7801\u4f1a\u4ee5\u660e\u6587\u4f20\u8f93\uff09\u3002\uff08\u4ee5\u524d\u7684 PostgreSQL \u7248\u672c\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u5b58\u50a8\u660e\u6587\u5bc6\u7801\uff0c\u4f46\u73b0\u5728\u5df2\u7ecf\u4e0d\u518d\u53ef\u80fd\u3002\uff09\u8981\u68c0\u67e5\u5f53\u524d\u5b58\u50a8\u7684\u5bc6\u7801 hash\uff0c\u53ef\u4ee5\u67e5\u770b\u7cfb\u7edf\u76ee\u5f55 <code class=\"literal\">pg_authid</code>\u3002</p>\n<p lang=\"zh\">\u8981\u5c06\u73b0\u6709\u5b89\u88c5\u4ece md5 \u5347\u7ea7\u5230 scram-sha-256\uff0c\u5e94\u5148\u786e\u8ba4\u6240\u6709\u4f7f\u7528\u4e2d\u7684\u5ba2\u6237\u7aef\u5e93\u7248\u672c\u90fd\u652f\u6301 SCRAM\uff1b\u7136\u540e\u5728 postgresql.conf \u4e2d\u8bbe\u7f6e password_encryption = 'scram-sha-256'\uff0c\u8ba9\u6240\u6709\u7528\u6237\u91cd\u65b0\u8bbe\u7f6e\u5bc6\u7801\uff0c\u5e76\u5c06 pg_hba.conf \u4e2d\u7684\u8ba4\u8bc1\u65b9\u6cd5\u6539\u4e3a scram-sha-256\u3002</p>\n</div>", "manual_path": "/docs/18/auth-password.html", "localization": {"status": "complete", "sources": [{"url": "/docs/18/auth-password.html", "method": "same-major semantic node", "sha256": "033ef5142713a61e9d92f15f25197231bf458e50f7e8c2fefaca46c0f070aab0", "language": "zh", "matched_nodes": ["#AUTH-PASSWORD/div[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]/p[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]/p[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[3]/div[2]/h3[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[3]/div[2]/p[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[3]/p[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[5]", "#AUTH-PASSWORD/p[4]", "#AUTH-PASSWORD/p[6]", "#AUTH-PASSWORD/p[7]"]}], "language": "zh", "original_text": {"/versions/18/description/0": "Require the client to supply an unencrypted password for authentication. Since the password is sent in clear text over the network, this should not be used on untrusted networks. See Section 20.5 for details.", "/versions/18/facts/0/label": "Method", "/versions/18/facts/1/label": "Configuration", "/versions/18/facts/2/label": "Inventory", "/versions/18/facts/2/value": "User-visible source authentication method", "/versions/18/tables/0/title": "Documented method options and alternatives", "/versions/18/tables/0/columns/0/label": "Option or term", "/versions/18/tables/0/columns/1/label": "Meaning", "/versions/18/tables/0/rows/0/description": "The method scram-sha-256 performs SCRAM-SHA-256 authentication, as described in RFC 7677 . It is a challenge-response scheme that prevents password sniffing on untrusted connections and supports storing passwords on the server in a cryptographically hashed form that is thought to be secure. This is the most secure of the currently provided methods, but it is not supported by older client libraries.", "/versions/18/tables/0/rows/1/description": "The method md5 uses a custom less secure challenge-response mechanism. It prevents password sniffing and avoids storing passwords on the server in plain text but provides no protection if an attacker manages to steal the password hash from the server. Also, the MD5 hash algorithm is nowadays no longer considered secure against determined attacks. To ease transition from the md5 method to the newer SCRAM method, if md5 is specified as a method in pg_hba.conf but the user's password on the server is encrypted for SCRAM (see below), then SCRAM-based authentication will automatically be chosen instead. Warning Support for MD5-encrypted passwords is deprecated and will be removed in a future release of PostgreSQL . Refer to the text below for details about migrating to another password type.", "/versions/18/tables/0/rows/2/description": "The method password sends the password in clear-text and is therefore vulnerable to password \u201c sniffing \u201d attacks. It should always be avoided if possible. If the connection is protected by SSL encryption then password can be used safely, though. (Though SSL certificate authentication might be a better choice if one is depending on using SSL)."}, "fallback_fields": [], "source_language": "en", "original_snapshot_sha256": "32dad5a7f1ee673f3116584aa42bb3fea9d3cdacabadd392d1b3a4c9ea708622"}, "comparison_data": {"method": "password", "documented_option_names": ["md5", "password", "scram-sha-256"]}, "comparison_hash": "d4a07ed4f297699ecd061181bcc656e57ea443c94b1d7536a172c08865099daf", "manual_language": "zh"}, "19": {"facts": [{"label": "\u65b9\u6cd5", "value": "password"}, {"label": "\u914d\u7f6e", "value": "pg_hba.conf"}, {"label": "\u6e05\u5355", "value": "\u7528\u6237\u53ef\u89c1\u7684\u6e90\u7801\u8ba4\u8bc1\u65b9\u6cd5"}], "tables": [{"key": "method-options", "rows": [{"name": "scram-sha-256", "description": "scram-sha-256 \u65b9\u6cd5\u6267\u884c SCRAM-SHA-256 \u8ba4\u8bc1\uff0c\u5176\u5b9a\u4e49\u89c1 RFC 7677 \u3002\u5b83\u662f\u4e00\u79cd\u6311\u6218-\u54cd\u5e94\u65b9\u6848\uff0c\u53ef\u9632\u6b62\u5728\u4e0d\u53d7\u4fe1\u4efb\u8fde\u63a5\u4e0a\u55c5\u63a2\u5bc6\u7801\uff0c\u5e76\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u88ab\u8ba4\u4e3a\u5b89\u5168\u7684\u5bc6\u7801\u5b66 hash \u5f62\u5f0f\u5b58\u50a8\u5bc6\u7801\u3002 \u8fd9\u662f\u5f53\u524d\u63d0\u4f9b\u7684\u65b9\u6cd5\u4e2d\u6700\u5b89\u5168\u7684\u4e00\u79cd\uff0c\u4f46\u662f\u65e7\u7684\u5ba2\u6237\u7aef\u5e93\u4e0d\u652f\u6301\u8fd9\u79cd\u65b9\u6cd5\u3002"}, {"name": "md5", "description": "md5 \u65b9\u6cd5\u4f7f\u7528\u81ea\u5b9a\u4e49\u4e14\u5b89\u5168\u6027\u8f83\u5f31\u7684\u6311\u6218\u54cd\u5e94\u673a\u5236\u3002\u5b83\u80fd\u9632\u6b62\u5bc6\u7801\u55c5\u63a2\uff0c\u907f\u514d\u670d\u52a1\u5668\u660e\u6587\u5b58\u50a8\u5bc6\u7801\uff1b\u4f46\u653b\u51fb\u8005\u4e00\u65e6\u7a83\u53d6\u670d\u52a1\u5668\u4e0a\u7684\u5bc6\u7801\u54c8\u5e0c\uff0c\u5c31\u65e0\u6cd5\u63d0\u4f9b\u4fdd\u62a4\u3002\u6b64\u5916\uff0cMD5 \u54c8\u5e0c\u7b97\u6cd5\u5982\u4eca\u5df2\u4e0d\u518d\u88ab\u8ba4\u4e3a\u80fd\u5b89\u5168\u62b5\u5fa1\u6709\u9488\u5bf9\u6027\u7684\u653b\u51fb\u3002\u4e3a\u4fbf\u4e8e\u4ece md5 \u8fc1\u79fb\u5230\u8f83\u65b0\u7684 SCRAM \u65b9\u6cd5\uff0c\u5982\u679c pg_hba.conf \u4e2d\u6307\u5b9a md5\uff0c\u4f46\u670d\u52a1\u5668\u4e0a\u8be5\u7528\u6237\u7684\u5bc6\u7801\u91c7\u7528 SCRAM \u52a0\u5bc6\u5b58\u50a8\uff08\u89c1\u4e0b\u6587\uff09\uff0c\u7cfb\u7edf\u4f1a\u81ea\u52a8\u6539\u7528\u57fa\u4e8e SCRAM \u7684\u8ba4\u8bc1\u3002\u8b66\u544a\uff1a\u5bf9 MD5 \u52a0\u5bc6\u5bc6\u7801\u7684\u652f\u6301\u5df2\u5f03\u7528\uff0c\u5c06\u5728 PostgreSQL \u7684\u672a\u6765\u7248\u672c\u4e2d\u79fb\u9664\u3002\u8fc1\u79fb\u5230\u5176\u4ed6\u5bc6\u7801\u7c7b\u578b\u7684\u65b9\u6cd5\u53c2\u89c1\u4e0b\u6587\u3002"}, {"name": "password", "description": "\u65b9\u6cd5 password \u4ee5\u660e\u6587\u5f62\u5f0f\u53d1\u9001\u5bc6\u7801\uff0c\u56e0\u6b64\u5b83\u5bb9\u6613\u53d7\u5230\u5bc6\u7801 \u201c \u55c5\u63a2 \u201d \u653b\u51fb\u3002\u5982\u679c\u53ef\u80fd\u5e94\u8be5\u5c3d\u91cf\u907f\u514d\u4f7f\u7528\u5b83\u3002\u4e0d\u8fc7\uff0c\u5982\u679c\u8fde\u63a5\u88abSSL\u52a0\u5bc6\u4fdd\u62a4\u7740\uff0c\u90a3\u4e48\u53ef\u4ee5\u5b89\u5168\u5730\u4f7f\u7528 password \uff08\u4e0d\u8fc7\u5982\u679c\u4f9d\u9760SSL\uff0cSSL\u8bc1\u4e66\u8ba4\u8bc1\u53ef\u80fd\u662f\u66f4\u597d\u7684\u9009\u62e9\uff09\u3002"}], "title": "\u624b\u518c\u4e2d\u7684\u65b9\u6cd5\u9009\u9879\u4e0e\u66ff\u4ee3\u65b9\u5f0f", "columns": [{"key": "name", "label": "\u9009\u9879\u6216\u672f\u8bed"}, {"key": "description", "label": "\u542b\u4e49"}]}], "aliases": [], "related": [], "release": {"ref": "https://ftp.postgresql.org/pub/source/v19beta4/postgresql-19beta4.tar.bz2", "label": "19beta4", "major": "19", "channel": "preview", "revision": "83157ee9c599d03b2f7a3d73ef3a56ec24e0e79cc2b3501a64d1364f56398c86", "source_sha256": "83157ee9c599d03b2f7a3d73ef3a56ec24e0e79cc2b3501a64d1364f56398c86", "catalog_fingerprint": "62fbf1a3689dbe8bf7e6b3372cfe6fbf867581427b3858a94c8419b77a4d2d1d"}, "sources": [{"url": "https://ftp.postgresql.org/pub/source/v19beta4/postgresql-19beta4.tar.bz2", "label": "Matching PostgreSQL source archive", "sha256": "83157ee9c599d03b2f7a3d73ef3a56ec24e0e79cc2b3501a64d1364f56398c86"}, {"url": "https://pg.center/docs/19/auth-password.html", "path": "auth-password.html", "label": "PostgreSQL 19 English manual", "sha256": "12a5a4b63b1571e98cdb62cd55570bb7947cbf2c218c6a8415eb75c382c9c652", "language": "en", "original_url": "/docs/19/auth-password.html"}, {"url": "https://pg.center/docs/19/auth-pg-hba-conf.html", "path": "auth-pg-hba-conf.html", "label": "PostgreSQL 19 English manual", "sha256": "d05e9155d5388148c2c680ff208b62c6b3b0b1c30f302ada5ab4befec36c19b7", "language": "en", "original_url": "/docs/19/auth-pg-hba-conf.html"}], "sections": [], "signature": "", "attributes": {"method": "password", "inventory": "User-visible source authentication method", "configuration": "pg_hba.conf"}, "description": ["\u8981\u6c42\u5ba2\u6237\u7aef\u63d0\u4f9b\u672a\u7ecf\u52a0\u5bc6\u7684\u5bc6\u7801\u8fdb\u884c\u8ba4\u8bc1\u3002\u7531\u4e8e\u5bc6\u7801\u901a\u8fc7\u7f51\u7edc\u660e\u6587\u4f20\u8f93\uff0c\u4e0d\u5e94\u5728\u4e0d\u53ef\u4fe1\u7f51\u7edc\u4e0a\u4f7f\u7528\u3002\u8be6\u60c5\u53c2\u89c1\u7b2c 20.5 \u8282\u3002"], "manual_html": "<div class=\"sect1\" id=\"AUTH-PASSWORD\">\n<div class=\"titlepage\">\n<div>\n<div>\n<h2 class=\"title\" lang=\"zh\">\n<div>\n<div>\n<h2 class=\"title\" style=\"clear: both\">20.5.\u00a0\u5bc6\u7801\u8ba4\u8bc1 </h2>\n</div>\n</div>\n</h2>\n</div>\n</div>\n</div>\n<p lang=\"zh\">\u6709\u51e0\u79cd\u57fa\u4e8e\u5bc6\u7801\u7684\u8ba4\u8bc1\u65b9\u6cd5\u3002\u8fd9\u4e9b\u65b9\u6cd5\u7684\u8fc7\u7a0b\u7c7b\u4f3c\uff0c\u4f46\u662f\u533a\u522b\u5728\u4e8e\u7528\u6237\u5bc6\u7801\u5982\u4f55\u5b58\u653e\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u53ca\u5ba2\u6237\u7aef\u63d0\u4f9b\u7684\u5bc6\u7801\u5982\u4f55\u901a\u8fc7\u8fde\u63a5\u53d1\u9001\u3002</p>\n<div class=\"variablelist\">\n<dl class=\"variablelist\">\n<dt><span class=\"term\"><code class=\"literal\">scram-sha-256</code></span></dt>\n<dd>\n<p lang=\"zh\"><code class=\"literal\">scram-sha-256</code> \u65b9\u6cd5\u6267\u884c SCRAM-SHA-256 \u8ba4\u8bc1\uff0c\u5176\u5b9a\u4e49\u89c1 <a class=\"ulink\" href=\"https://datatracker.ietf.org/doc/html/rfc7677\" target=\"_top\">RFC 7677</a>\u3002\u5b83\u662f\u4e00\u79cd\u6311\u6218-\u54cd\u5e94\u65b9\u6848\uff0c\u53ef\u9632\u6b62\u5728\u4e0d\u53d7\u4fe1\u4efb\u8fde\u63a5\u4e0a\u55c5\u63a2\u5bc6\u7801\uff0c\u5e76\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u88ab\u8ba4\u4e3a\u5b89\u5168\u7684\u5bc6\u7801\u5b66 hash \u5f62\u5f0f\u5b58\u50a8\u5bc6\u7801\u3002</p>\n<p lang=\"zh\">\u8fd9\u662f\u5f53\u524d\u63d0\u4f9b\u7684\u65b9\u6cd5\u4e2d\u6700\u5b89\u5168\u7684\u4e00\u79cd\uff0c\u4f46\u662f\u65e7\u7684\u5ba2\u6237\u7aef\u5e93\u4e0d\u652f\u6301\u8fd9\u79cd\u65b9\u6cd5\u3002</p>\n</dd>\n<dt><span class=\"term\"><code class=\"literal\">md5</code></span></dt>\n<dd>\n<p lang=\"zh\">\u65b9\u6cd5<code class=\"literal\">md5</code>\u4f7f\u7528\u4e00\u79cd\u81ea\u5b9a\u4e49\u7684\u3001\u5b89\u5168\u6027\u8f83\u4f4e\u7684\u6311\u6218-\u54cd\u5e94\u673a\u5236\u3002\u5b83\u80fd\u9632\u6b62\u5bc6\u7801\u55c5\u63a2\uff0c\u5e76\u907f\u514d\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u660e\u6587\u5b58\u50a8\u5bc6\u7801\uff1b\u4f46\u5982\u679c\u653b\u51fb\u8005\u8bbe\u6cd5\u4ece\u670d\u52a1\u5668\u4e0a\u7a83\u53d6\u4e86\u5bc6\u7801 hash\uff0c\u5b83\u5c31\u65e0\u6cd5\u63d0\u4f9b\u4fdd\u62a4\u3002\u6b64\u5916\uff0c\u5982\u4eca\u5df2\u4e0d\u518d\u8ba4\u4e3a MD5 hash \u7b97\u6cd5\u80fd\u62b5\u5fa1\u6709\u51b3\u5fc3\u7684\u653b\u51fb\u8005\u3002</p>\n<p lang=\"zh\">\u4e3a\u4fbf\u4e8e\u4ece md5 \u8fc1\u79fb\u5230\u8f83\u65b0\u7684 SCRAM \u65b9\u6cd5\uff0c\u5982\u679c pg_hba.conf \u4e2d\u6307\u5b9a md5\uff0c\u4f46\u670d\u52a1\u5668\u4e0a\u8be5\u7528\u6237\u7684\u5bc6\u7801\u91c7\u7528 SCRAM \u52a0\u5bc6\u5b58\u50a8\uff08\u89c1\u4e0b\u6587\uff09\uff0c\u7cfb\u7edf\u4f1a\u81ea\u52a8\u6539\u7528\u57fa\u4e8e SCRAM \u7684\u8ba4\u8bc1\u3002</p>\n<div class=\"warning\">\n<h3 class=\"title\" lang=\"zh\">\u8b66\u544a</h3>\n<p lang=\"zh\">\u5bf9 MD5 \u52a0\u5bc6\u5bc6\u7801\u7684\u652f\u6301\u5df2\u5f03\u7528\uff0c\u5e76\u5c06\u5728<span class=\"productname\">PostgreSQL</span>\u7684\u672a\u6765\u7248\u672c\u4e2d\u79fb\u9664\u3002\u8fc1\u79fb\u5230\u5176\u4ed6\u5bc6\u7801\u7c7b\u578b\u7684\u8be6\u7ec6\u4fe1\u606f\u89c1\u4e0b\u6587\u3002</p>\n</div>\n</dd>\n<dt><span class=\"term\"><code class=\"literal\">password</code></span></dt>\n<dd>\n<p lang=\"zh\">\n<p>\u65b9\u6cd5<code class=\"literal\">password</code>\u4ee5\u660e\u6587\u5f62\u5f0f\u53d1\u9001\u5bc6\u7801\uff0c\u56e0\u6b64\u5b83\u5bb9\u6613\u53d7\u5230\u5bc6\u7801<span class=\"quote\">\u201c<span class=\"quote\">\u55c5\u63a2</span>\u201d</span>\u653b\u51fb\u3002\u5982\u679c\u53ef\u80fd\u5e94\u8be5\u5c3d\u91cf\u907f\u514d\u4f7f\u7528\u5b83\u3002\u4e0d\u8fc7\uff0c\u5982\u679c\u8fde\u63a5\u88abSSL\u52a0\u5bc6\u4fdd\u62a4\u7740\uff0c\u90a3\u4e48\u53ef\u4ee5\u5b89\u5168\u5730\u4f7f\u7528<code class=\"literal\">password</code>\uff08\u4e0d\u8fc7\u5982\u679c\u4f9d\u9760SSL\uff0cSSL\u8bc1\u4e66\u8ba4\u8bc1\u53ef\u80fd\u662f\u66f4\u597d\u7684\u9009\u62e9\uff09\u3002</p>\n</p>\n</dd>\n</dl>\n</div>\n<p lang=\"zh\"><span class=\"productname\">PostgreSQL</span> \u6570\u636e\u5e93\u5bc6\u7801\u72ec\u7acb\u4e8e\u64cd\u4f5c\u7cfb\u7edf\u7528\u6237\u5bc6\u7801\u3002\u6bcf\u4e2a\u6570\u636e\u5e93\u7528\u6237\u7684\u5bc6\u7801\u90fd\u5b58\u50a8\u5728\u7cfb\u7edf\u76ee\u5f55 <code class=\"literal\">pg_authid</code> \u4e2d\u3002\u5bc6\u7801\u53ef\u4ee5\u901a\u8fc7 SQL \u547d\u4ee4<a class=\"xref\" href=\"/docs/19/sql-createrole.html\" title=\"CREATE ROLE\"><span class=\"refentrytitle\">CREATE ROLE</span></a>\u548c<a class=\"xref\" href=\"/docs/19/sql-alterrole.html\" title=\"ALTER ROLE\"><span class=\"refentrytitle\">ALTER ROLE</span></a>\u7ba1\u7406\uff0c\u4f8b\u5982 <strong class=\"userinput\"><code>CREATE ROLE foo WITH LOGIN PASSWORD 'secret'</code></strong>\uff0c\u6216\u8005\u901a\u8fc7 <span class=\"application\">psql</span> \u7684 <code class=\"literal\">\\password</code> \u547d\u4ee4\u7ba1\u7406\u3002\u5982\u679c\u67d0\u4e2a\u7528\u6237\u6ca1\u6709\u8bbe\u7f6e\u5bc6\u7801\uff0c\u5219\u5176\u5b58\u50a8\u5bc6\u7801\u4e3a null\uff0c\u8be5\u7528\u6237\u7684\u5bc6\u7801\u8ba4\u8bc1\u5c06\u59cb\u7ec8\u5931\u8d25\u3002</p>\n<p lang=\"zh\">\u4e0d\u540c\u57fa\u4e8e\u5bc6\u7801\u7684\u8ba4\u8bc1\u65b9\u6cd5\u662f\u5426\u53ef\u7528\uff0c\u53d6\u51b3\u4e8e\u7528\u6237\u5728\u670d\u52a1\u5668\u4e0a\u7684\u5bc6\u7801\u662f\u5982\u4f55\u52a0\u5bc6\u7684\uff08\u66f4\u51c6\u786e\u5730\u8bf4\uff0c\u662f\u5982\u4f55\u8fdb\u884c hash \u8fd0\u7b97\u7684\uff09\u3002\u8fd9\u7531\u8bbe\u7f6e\u5bc6\u7801\u65f6\u7684\u914d\u7f6e\u53c2\u6570<a class=\"xref\" href=\"/docs/19/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION\">password_encryption</a>\u63a7\u5236\u3002\u5982\u679c\u5bc6\u7801\u662f\u4f7f\u7528 <code class=\"literal\">scram-sha-256</code> \u8bbe\u7f6e\u52a0\u5bc6\u7684\uff0c\u90a3\u4e48\u5b83\u53ef\u4ee5\u7528\u4e8e <code class=\"literal\">scram-sha-256</code> \u548c <code class=\"literal\">password</code> \u8ba4\u8bc1\u65b9\u6cd5\uff08\u4f46\u540e\u4e00\u79cd\u60c5\u51b5\u4e0b\u5bc6\u7801\u4f1a\u4ee5\u660e\u6587\u4f20\u8f93\uff09\u3002\u5982\u4e0a\u6240\u8ff0\uff0c\u6b64\u65f6\u5982\u679c\u8ba4\u8bc1\u65b9\u6cd5\u6307\u5b9a\u4e3a <code class=\"literal\">md5</code>\uff0c\u4e5f\u4f1a\u81ea\u52a8\u5207\u6362\u4e3a\u4f7f\u7528 <code class=\"literal\">scram-sha-256</code>\uff0c\u56e0\u6b64\u540c\u6837\u80fd\u591f\u5de5\u4f5c\u3002\u5982\u679c\u5bc6\u7801\u662f\u4f7f\u7528 <code class=\"literal\">md5</code> \u8bbe\u7f6e\u52a0\u5bc6\u7684\uff0c\u90a3\u4e48\u5b83\u53ea\u80fd\u7528\u4e8e <code class=\"literal\">md5</code> \u548c <code class=\"literal\">password</code> \u8ba4\u8bc1\u65b9\u6cd5\uff08\u540c\u6837\uff0c\u540e\u4e00\u79cd\u60c5\u51b5\u4e0b\u5bc6\u7801\u4f1a\u4ee5\u660e\u6587\u4f20\u8f93\uff09\u3002\uff08\u4ee5\u524d\u7684 PostgreSQL \u7248\u672c\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u5b58\u50a8\u660e\u6587\u5bc6\u7801\uff0c\u4f46\u73b0\u5728\u5df2\u7ecf\u4e0d\u518d\u53ef\u80fd\u3002\uff09\u8981\u68c0\u67e5\u5f53\u524d\u5b58\u50a8\u7684\u5bc6\u7801 hash\uff0c\u53ef\u4ee5\u67e5\u770b\u7cfb\u7edf\u76ee\u5f55 <code class=\"literal\">pg_authid</code>\u3002</p>\n<p lang=\"zh\">\u8981\u5c06\u73b0\u6709\u5b89\u88c5\u4ece md5 \u5347\u7ea7\u5230 scram-sha-256\uff0c\u5e94\u5148\u786e\u8ba4\u6240\u6709\u4f7f\u7528\u4e2d\u7684\u5ba2\u6237\u7aef\u5e93\u7248\u672c\u90fd\u652f\u6301 SCRAM\uff1b\u7136\u540e\u5728 postgresql.conf \u4e2d\u8bbe\u7f6e password_encryption = 'scram-sha-256'\uff0c\u8ba9\u6240\u6709\u7528\u6237\u91cd\u65b0\u8bbe\u7f6e\u5bc6\u7801\uff0c\u5e76\u5c06 pg_hba.conf \u4e2d\u7684\u8ba4\u8bc1\u65b9\u6cd5\u6539\u4e3a scram-sha-256\u3002</p>\n</div>", "manual_path": "/docs/19/auth-password.html", "localization": {"status": "complete", "sources": [{"url": "/docs/19/auth-password.html", "method": "same-major semantic node", "sha256": "444f995deb639764ea4f0b47315e0e23bce773d9826e593daa84e4709a89b484", "language": "zh", "matched_nodes": ["#AUTH-PASSWORD/div[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]/p[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]/p[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[3]/div[2]/h3[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[3]/div[2]/p[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[3]/p[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[5]", "#AUTH-PASSWORD/p[4]", "#AUTH-PASSWORD/p[6]", "#AUTH-PASSWORD/p[7]"]}], "language": "zh", "original_text": {"/versions/19/description/0": "Require the client to supply an unencrypted password for authentication. Since the password is sent in clear text over the network, this should not be used on untrusted networks. See Section 20.5 for details.", "/versions/19/facts/0/label": "Method", "/versions/19/facts/1/label": "Configuration", "/versions/19/facts/2/label": "Inventory", "/versions/19/facts/2/value": "User-visible source authentication method", "/versions/19/tables/0/title": "Documented method options and alternatives", "/versions/19/tables/0/columns/0/label": "Option or term", "/versions/19/tables/0/columns/1/label": "Meaning", "/versions/19/tables/0/rows/0/description": "The method scram-sha-256 performs SCRAM-SHA-256 authentication, as described in RFC 7677 . It is a challenge-response scheme that prevents password sniffing on untrusted connections and supports storing passwords on the server in a cryptographically hashed form that is thought to be secure. This is the most secure of the currently provided methods, but it is not supported by older client libraries.", "/versions/19/tables/0/rows/1/description": "The method md5 uses a custom less secure challenge-response mechanism. It prevents password sniffing and avoids storing passwords on the server in plain text but provides no protection if an attacker manages to steal the password hash from the server. Also, the MD5 hash algorithm is nowadays no longer considered secure against determined attacks. To ease transition from the md5 method to the newer SCRAM method, if md5 is specified as a method in pg_hba.conf but the user's password on the server is encrypted for SCRAM (see below), then SCRAM-based authentication will automatically be chosen instead. Warning Support for MD5-encrypted passwords is deprecated and will be removed in a future release of PostgreSQL . Refer to the text below for details about migrating to another password type.", "/versions/19/tables/0/rows/2/description": "The method password sends the password in clear-text and is therefore vulnerable to password \u201c sniffing \u201d attacks. It should always be avoided if possible. If the connection is protected by SSL encryption then password can be used safely, though. (Though SSL certificate authentication might be a better choice if one is depending on using SSL)."}, "fallback_fields": [], "source_language": "en", "original_snapshot_sha256": "c5e0df2b46cdf6666ade542560380a98975ec7ac258f4ca211e26c8ffda1d36e"}, "comparison_data": {"method": "password", "documented_option_names": ["md5", "password", "scram-sha-256"]}, "comparison_hash": "d4a07ed4f297699ecd061181bcc656e57ea443c94b1d7536a172c08865099daf", "manual_language": "zh"}, "20": {"facts": [{"label": "\u65b9\u6cd5", "value": "password"}, {"label": "\u914d\u7f6e", "value": "pg_hba.conf"}, {"label": "\u6e05\u5355", "value": "\u7528\u6237\u53ef\u89c1\u7684\u6e90\u7801\u8ba4\u8bc1\u65b9\u6cd5"}], "tables": [{"key": "method-options", "rows": [{"name": "scram-sha-256", "description": "scram-sha-256 \u65b9\u6cd5\u6267\u884c SCRAM-SHA-256 \u8ba4\u8bc1\uff0c\u5176\u5b9a\u4e49\u89c1 RFC 7677 \u3002\u5b83\u662f\u4e00\u79cd\u6311\u6218-\u54cd\u5e94\u65b9\u6848\uff0c\u53ef\u9632\u6b62\u5728\u4e0d\u53d7\u4fe1\u4efb\u8fde\u63a5\u4e0a\u55c5\u63a2\u5bc6\u7801\uff0c\u5e76\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u88ab\u8ba4\u4e3a\u5b89\u5168\u7684\u5bc6\u7801\u5b66 hash \u5f62\u5f0f\u5b58\u50a8\u5bc6\u7801\u3002 \u8fd9\u662f\u5f53\u524d\u63d0\u4f9b\u7684\u65b9\u6cd5\u4e2d\u6700\u5b89\u5168\u7684\u4e00\u79cd\uff0c\u4f46\u662f\u65e7\u7684\u5ba2\u6237\u7aef\u5e93\u4e0d\u652f\u6301\u8fd9\u79cd\u65b9\u6cd5\u3002"}, {"name": "md5", "description": "md5 \u65b9\u6cd5\u4f7f\u7528\u81ea\u5b9a\u4e49\u4e14\u5b89\u5168\u6027\u8f83\u5f31\u7684\u6311\u6218\u54cd\u5e94\u673a\u5236\u3002\u5b83\u80fd\u9632\u6b62\u5bc6\u7801\u55c5\u63a2\uff0c\u907f\u514d\u670d\u52a1\u5668\u660e\u6587\u5b58\u50a8\u5bc6\u7801\uff1b\u4f46\u653b\u51fb\u8005\u4e00\u65e6\u7a83\u53d6\u670d\u52a1\u5668\u4e0a\u7684\u5bc6\u7801\u54c8\u5e0c\uff0c\u5c31\u65e0\u6cd5\u63d0\u4f9b\u4fdd\u62a4\u3002\u6b64\u5916\uff0cMD5 \u54c8\u5e0c\u7b97\u6cd5\u5982\u4eca\u5df2\u4e0d\u518d\u88ab\u8ba4\u4e3a\u80fd\u5b89\u5168\u62b5\u5fa1\u6709\u9488\u5bf9\u6027\u7684\u653b\u51fb\u3002\u4e3a\u4fbf\u4e8e\u4ece md5 \u8fc1\u79fb\u5230\u8f83\u65b0\u7684 SCRAM \u65b9\u6cd5\uff0c\u5982\u679c pg_hba.conf \u4e2d\u6307\u5b9a md5\uff0c\u4f46\u670d\u52a1\u5668\u4e0a\u8be5\u7528\u6237\u7684\u5bc6\u7801\u91c7\u7528 SCRAM \u52a0\u5bc6\u5b58\u50a8\uff08\u89c1\u4e0b\u6587\uff09\uff0c\u7cfb\u7edf\u4f1a\u81ea\u52a8\u6539\u7528\u57fa\u4e8e SCRAM \u7684\u8ba4\u8bc1\u3002\u8b66\u544a\uff1a\u5bf9 MD5 \u52a0\u5bc6\u5bc6\u7801\u7684\u652f\u6301\u5df2\u5f03\u7528\uff0c\u5c06\u5728 PostgreSQL \u7684\u672a\u6765\u7248\u672c\u4e2d\u79fb\u9664\u3002\u8fc1\u79fb\u5230\u5176\u4ed6\u5bc6\u7801\u7c7b\u578b\u7684\u65b9\u6cd5\u53c2\u89c1\u4e0b\u6587\u3002"}, {"name": "password", "description": "\u65b9\u6cd5 password \u4ee5\u660e\u6587\u5f62\u5f0f\u53d1\u9001\u5bc6\u7801\uff0c\u56e0\u6b64\u5b83\u5bb9\u6613\u53d7\u5230\u5bc6\u7801 \u201c \u55c5\u63a2 \u201d \u653b\u51fb\u3002\u5982\u679c\u53ef\u80fd\u5e94\u8be5\u5c3d\u91cf\u907f\u514d\u4f7f\u7528\u5b83\u3002\u4e0d\u8fc7\uff0c\u5982\u679c\u8fde\u63a5\u88abSSL\u52a0\u5bc6\u4fdd\u62a4\u7740\uff0c\u90a3\u4e48\u53ef\u4ee5\u5b89\u5168\u5730\u4f7f\u7528 password \uff08\u4e0d\u8fc7\u5982\u679c\u4f9d\u9760SSL\uff0cSSL\u8bc1\u4e66\u8ba4\u8bc1\u53ef\u80fd\u662f\u66f4\u597d\u7684\u9009\u62e9\uff09\u3002"}], "title": "\u624b\u518c\u4e2d\u7684\u65b9\u6cd5\u9009\u9879\u4e0e\u66ff\u4ee3\u65b9\u5f0f", "columns": [{"key": "name", "label": "\u9009\u9879\u6216\u672f\u8bed"}, {"key": "description", "label": "\u542b\u4e49"}]}], "aliases": [], "related": [], "release": {"ref": "https://ftp.postgresql.org/pub/snapshot/dev/postgresql-snapshot.tar.bz2", "label": "20devel", "major": "20", "channel": "devel", "revision": "4d3346909b201ac1648232cf290462a7070c119326f56196f1f0253ed80fae41", "source_sha256": "4d3346909b201ac1648232cf290462a7070c119326f56196f1f0253ed80fae41", "catalog_fingerprint": "398fbb9f262264053c02fbf79f88be0a6770c1473faa6ecd5931d6ec41b8258b", "source_snapshot_utc": "26-Sep-2026 20:22"}, "sources": [{"url": "https://ftp.postgresql.org/pub/snapshot/dev/postgresql-snapshot.tar.bz2", "label": "Matching PostgreSQL source archive", "sha256": "4d3346909b201ac1648232cf290462a7070c119326f56196f1f0253ed80fae41"}, {"url": "https://pg.center/docs/devel/auth-password.html", "path": "auth-password.html", "label": "PostgreSQL 20 English manual", "sha256": "a3d794d9f8f9fc8fb0afefa23dfb23ef9476bc8acc0305d7478a1f81aca822e1", "language": "en", "original_url": "/docs/devel/auth-password.html"}, {"url": "https://pg.center/docs/devel/auth-pg-hba-conf.html", "path": "auth-pg-hba-conf.html", "label": "PostgreSQL 20 English manual", "sha256": "cf2069461da3eec62f6fb4e3df8e46fd69ff4b3a2ad059eec355cee256d7996e", "language": "en", "original_url": "/docs/devel/auth-pg-hba-conf.html"}], "sections": [], "signature": "", "attributes": {"method": "password", "inventory": "User-visible source authentication method", "configuration": "pg_hba.conf"}, "description": ["\u8981\u6c42\u5ba2\u6237\u7aef\u63d0\u4f9b\u672a\u7ecf\u52a0\u5bc6\u7684\u5bc6\u7801\u8fdb\u884c\u8ba4\u8bc1\u3002\u7531\u4e8e\u5bc6\u7801\u901a\u8fc7\u7f51\u7edc\u660e\u6587\u4f20\u8f93\uff0c\u4e0d\u5e94\u5728\u4e0d\u53ef\u4fe1\u7f51\u7edc\u4e0a\u4f7f\u7528\u3002\u8be6\u60c5\u53c2\u89c1\u7b2c 20.5 \u8282\u3002"], "manual_html": "<div class=\"sect1\" id=\"AUTH-PASSWORD\">\n<div class=\"titlepage\">\n<div>\n<div>\n<h2 class=\"title\" lang=\"zh\">\n<div>\n<div>\n<h2 class=\"title\" style=\"clear: both\">20.5.\u00a0\u5bc6\u7801\u8ba4\u8bc1 </h2>\n</div>\n</div>\n</h2>\n</div>\n</div>\n</div>\n<p lang=\"zh\">\u6709\u51e0\u79cd\u57fa\u4e8e\u5bc6\u7801\u7684\u8ba4\u8bc1\u65b9\u6cd5\u3002\u8fd9\u4e9b\u65b9\u6cd5\u7684\u8fc7\u7a0b\u7c7b\u4f3c\uff0c\u4f46\u662f\u533a\u522b\u5728\u4e8e\u7528\u6237\u5bc6\u7801\u5982\u4f55\u5b58\u653e\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u53ca\u5ba2\u6237\u7aef\u63d0\u4f9b\u7684\u5bc6\u7801\u5982\u4f55\u901a\u8fc7\u8fde\u63a5\u53d1\u9001\u3002</p>\n<div class=\"variablelist\">\n<dl class=\"variablelist\">\n<dt><span class=\"term\"><code class=\"literal\">scram-sha-256</code></span></dt>\n<dd>\n<p lang=\"zh\"><code class=\"literal\">scram-sha-256</code> \u65b9\u6cd5\u6267\u884c SCRAM-SHA-256 \u8ba4\u8bc1\uff0c\u5176\u5b9a\u4e49\u89c1 <a class=\"ulink\" href=\"https://datatracker.ietf.org/doc/html/rfc7677\" target=\"_top\">RFC 7677</a>\u3002\u5b83\u662f\u4e00\u79cd\u6311\u6218-\u54cd\u5e94\u65b9\u6848\uff0c\u53ef\u9632\u6b62\u5728\u4e0d\u53d7\u4fe1\u4efb\u8fde\u63a5\u4e0a\u55c5\u63a2\u5bc6\u7801\uff0c\u5e76\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u88ab\u8ba4\u4e3a\u5b89\u5168\u7684\u5bc6\u7801\u5b66 hash \u5f62\u5f0f\u5b58\u50a8\u5bc6\u7801\u3002</p>\n<p lang=\"zh\">\u8fd9\u662f\u5f53\u524d\u63d0\u4f9b\u7684\u65b9\u6cd5\u4e2d\u6700\u5b89\u5168\u7684\u4e00\u79cd\uff0c\u4f46\u662f\u65e7\u7684\u5ba2\u6237\u7aef\u5e93\u4e0d\u652f\u6301\u8fd9\u79cd\u65b9\u6cd5\u3002</p>\n</dd>\n<dt><span class=\"term\"><code class=\"literal\">md5</code></span></dt>\n<dd>\n<p lang=\"zh\">\u65b9\u6cd5<code class=\"literal\">md5</code>\u4f7f\u7528\u4e00\u79cd\u81ea\u5b9a\u4e49\u7684\u3001\u5b89\u5168\u6027\u8f83\u4f4e\u7684\u6311\u6218-\u54cd\u5e94\u673a\u5236\u3002\u5b83\u80fd\u9632\u6b62\u5bc6\u7801\u55c5\u63a2\uff0c\u5e76\u907f\u514d\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u660e\u6587\u5b58\u50a8\u5bc6\u7801\uff1b\u4f46\u5982\u679c\u653b\u51fb\u8005\u8bbe\u6cd5\u4ece\u670d\u52a1\u5668\u4e0a\u7a83\u53d6\u4e86\u5bc6\u7801 hash\uff0c\u5b83\u5c31\u65e0\u6cd5\u63d0\u4f9b\u4fdd\u62a4\u3002\u6b64\u5916\uff0c\u5982\u4eca\u5df2\u4e0d\u518d\u8ba4\u4e3a MD5 hash \u7b97\u6cd5\u80fd\u62b5\u5fa1\u6709\u51b3\u5fc3\u7684\u653b\u51fb\u8005\u3002</p>\n<p lang=\"zh\">\u4e3a\u4fbf\u4e8e\u4ece md5 \u8fc1\u79fb\u5230\u8f83\u65b0\u7684 SCRAM \u65b9\u6cd5\uff0c\u5982\u679c pg_hba.conf \u4e2d\u6307\u5b9a md5\uff0c\u4f46\u670d\u52a1\u5668\u4e0a\u8be5\u7528\u6237\u7684\u5bc6\u7801\u91c7\u7528 SCRAM \u52a0\u5bc6\u5b58\u50a8\uff08\u89c1\u4e0b\u6587\uff09\uff0c\u7cfb\u7edf\u4f1a\u81ea\u52a8\u6539\u7528\u57fa\u4e8e SCRAM \u7684\u8ba4\u8bc1\u3002</p>\n<div class=\"warning\">\n<h3 class=\"title\" lang=\"zh\">\u8b66\u544a</h3>\n<p lang=\"zh\">\u5bf9 MD5 \u52a0\u5bc6\u5bc6\u7801\u7684\u652f\u6301\u5df2\u5f03\u7528\uff0c\u5e76\u5c06\u5728<span class=\"productname\">PostgreSQL</span>\u7684\u672a\u6765\u7248\u672c\u4e2d\u79fb\u9664\u3002\u8fc1\u79fb\u5230\u5176\u4ed6\u5bc6\u7801\u7c7b\u578b\u7684\u8be6\u7ec6\u4fe1\u606f\u89c1\u4e0b\u6587\u3002</p>\n</div>\n</dd>\n<dt><span class=\"term\"><code class=\"literal\">password</code></span></dt>\n<dd>\n<p lang=\"zh\">\n<p>\u65b9\u6cd5<code class=\"literal\">password</code>\u4ee5\u660e\u6587\u5f62\u5f0f\u53d1\u9001\u5bc6\u7801\uff0c\u56e0\u6b64\u5b83\u5bb9\u6613\u53d7\u5230\u5bc6\u7801<span class=\"quote\">\u201c<span class=\"quote\">\u55c5\u63a2</span>\u201d</span>\u653b\u51fb\u3002\u5982\u679c\u53ef\u80fd\u5e94\u8be5\u5c3d\u91cf\u907f\u514d\u4f7f\u7528\u5b83\u3002\u4e0d\u8fc7\uff0c\u5982\u679c\u8fde\u63a5\u88abSSL\u52a0\u5bc6\u4fdd\u62a4\u7740\uff0c\u90a3\u4e48\u53ef\u4ee5\u5b89\u5168\u5730\u4f7f\u7528<code class=\"literal\">password</code>\uff08\u4e0d\u8fc7\u5982\u679c\u4f9d\u9760SSL\uff0cSSL\u8bc1\u4e66\u8ba4\u8bc1\u53ef\u80fd\u662f\u66f4\u597d\u7684\u9009\u62e9\uff09\u3002</p>\n</p>\n</dd>\n</dl>\n</div>\n<p lang=\"zh\"><span class=\"productname\">PostgreSQL</span> \u6570\u636e\u5e93\u5bc6\u7801\u72ec\u7acb\u4e8e\u64cd\u4f5c\u7cfb\u7edf\u7528\u6237\u5bc6\u7801\u3002\u6bcf\u4e2a\u6570\u636e\u5e93\u7528\u6237\u7684\u5bc6\u7801\u90fd\u5b58\u50a8\u5728\u7cfb\u7edf\u76ee\u5f55 <code class=\"literal\">pg_authid</code> \u4e2d\u3002\u5bc6\u7801\u53ef\u4ee5\u901a\u8fc7 SQL \u547d\u4ee4<a class=\"xref\" href=\"/docs/devel/sql-createrole.html\" title=\"CREATE ROLE\"><span class=\"refentrytitle\">CREATE ROLE</span></a>\u548c<a class=\"xref\" href=\"/docs/devel/sql-alterrole.html\" title=\"ALTER ROLE\"><span class=\"refentrytitle\">ALTER ROLE</span></a>\u7ba1\u7406\uff0c\u4f8b\u5982 <strong class=\"userinput\"><code>CREATE ROLE foo WITH LOGIN PASSWORD 'secret'</code></strong>\uff0c\u6216\u8005\u901a\u8fc7 <span class=\"application\">psql</span> \u7684 <code class=\"literal\">\\password</code> \u547d\u4ee4\u7ba1\u7406\u3002\u5982\u679c\u67d0\u4e2a\u7528\u6237\u6ca1\u6709\u8bbe\u7f6e\u5bc6\u7801\uff0c\u5219\u5176\u5b58\u50a8\u5bc6\u7801\u4e3a null\uff0c\u8be5\u7528\u6237\u7684\u5bc6\u7801\u8ba4\u8bc1\u5c06\u59cb\u7ec8\u5931\u8d25\u3002</p>\n<p lang=\"zh\">\u4e0d\u540c\u57fa\u4e8e\u5bc6\u7801\u7684\u8ba4\u8bc1\u65b9\u6cd5\u662f\u5426\u53ef\u7528\uff0c\u53d6\u51b3\u4e8e\u7528\u6237\u5728\u670d\u52a1\u5668\u4e0a\u7684\u5bc6\u7801\u662f\u5982\u4f55\u52a0\u5bc6\u7684\uff08\u66f4\u51c6\u786e\u5730\u8bf4\uff0c\u662f\u5982\u4f55\u8fdb\u884c hash \u8fd0\u7b97\u7684\uff09\u3002\u8fd9\u7531\u8bbe\u7f6e\u5bc6\u7801\u65f6\u7684\u914d\u7f6e\u53c2\u6570<a class=\"xref\" href=\"/docs/devel/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION\">password_encryption</a>\u63a7\u5236\u3002\u5982\u679c\u5bc6\u7801\u662f\u4f7f\u7528 <code class=\"literal\">scram-sha-256</code> \u8bbe\u7f6e\u52a0\u5bc6\u7684\uff0c\u90a3\u4e48\u5b83\u53ef\u4ee5\u7528\u4e8e <code class=\"literal\">scram-sha-256</code> \u548c <code class=\"literal\">password</code> \u8ba4\u8bc1\u65b9\u6cd5\uff08\u4f46\u540e\u4e00\u79cd\u60c5\u51b5\u4e0b\u5bc6\u7801\u4f1a\u4ee5\u660e\u6587\u4f20\u8f93\uff09\u3002\u5982\u4e0a\u6240\u8ff0\uff0c\u6b64\u65f6\u5982\u679c\u8ba4\u8bc1\u65b9\u6cd5\u6307\u5b9a\u4e3a <code class=\"literal\">md5</code>\uff0c\u4e5f\u4f1a\u81ea\u52a8\u5207\u6362\u4e3a\u4f7f\u7528 <code class=\"literal\">scram-sha-256</code>\uff0c\u56e0\u6b64\u540c\u6837\u80fd\u591f\u5de5\u4f5c\u3002\u5982\u679c\u5bc6\u7801\u662f\u4f7f\u7528 <code class=\"literal\">md5</code> \u8bbe\u7f6e\u52a0\u5bc6\u7684\uff0c\u90a3\u4e48\u5b83\u53ea\u80fd\u7528\u4e8e <code class=\"literal\">md5</code> \u548c <code class=\"literal\">password</code> \u8ba4\u8bc1\u65b9\u6cd5\uff08\u540c\u6837\uff0c\u540e\u4e00\u79cd\u60c5\u51b5\u4e0b\u5bc6\u7801\u4f1a\u4ee5\u660e\u6587\u4f20\u8f93\uff09\u3002\uff08\u4ee5\u524d\u7684 PostgreSQL \u7248\u672c\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u5b58\u50a8\u660e\u6587\u5bc6\u7801\uff0c\u4f46\u73b0\u5728\u5df2\u7ecf\u4e0d\u518d\u53ef\u80fd\u3002\uff09\u8981\u68c0\u67e5\u5f53\u524d\u5b58\u50a8\u7684\u5bc6\u7801 hash\uff0c\u53ef\u4ee5\u67e5\u770b\u7cfb\u7edf\u76ee\u5f55 <code class=\"literal\">pg_authid</code>\u3002</p>\n<p lang=\"zh\">\u8981\u5c06\u73b0\u6709\u5b89\u88c5\u4ece md5 \u5347\u7ea7\u5230 scram-sha-256\uff0c\u5e94\u5148\u786e\u8ba4\u6240\u6709\u4f7f\u7528\u4e2d\u7684\u5ba2\u6237\u7aef\u5e93\u7248\u672c\u90fd\u652f\u6301 SCRAM\uff1b\u7136\u540e\u5728 postgresql.conf \u4e2d\u8bbe\u7f6e password_encryption = 'scram-sha-256'\uff0c\u8ba9\u6240\u6709\u7528\u6237\u91cd\u65b0\u8bbe\u7f6e\u5bc6\u7801\uff0c\u5e76\u5c06 pg_hba.conf \u4e2d\u7684\u8ba4\u8bc1\u65b9\u6cd5\u6539\u4e3a scram-sha-256\u3002</p>\n</div>", "manual_path": "/docs/devel/auth-password.html", "localization": {"status": "complete", "sources": [{"url": "/docs/devel/auth-password.html", "method": "same-major semantic node", "sha256": "3564fcac9148461e1a979239ae53e050a4cb099089cf40c997c9c698159007f9", "language": "zh", "matched_nodes": ["#AUTH-PASSWORD/div[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]/p[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]/p[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[3]/div[2]/h3[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[3]/div[2]/p[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[3]/p[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[5]", "#AUTH-PASSWORD/p[4]", "#AUTH-PASSWORD/p[6]", "#AUTH-PASSWORD/p[7]"]}], "language": "zh", "original_text": {"/summary": "Require the client to supply an unencrypted password for authentication. Since the password is sent in clear text over the network, this should not be used on untrusted networks. See Section 20.5 for details.", "/category": "Password authentication", "/versions/20/description/0": "Require the client to supply an unencrypted password for authentication. Since the password is sent in clear text over the network, this should not be used on untrusted networks. See Section 20.5 for details.", "/versions/20/facts/0/label": "Method", "/versions/20/facts/1/label": "Configuration", "/versions/20/facts/2/label": "Inventory", "/versions/20/facts/2/value": "User-visible source authentication method", "/versions/20/tables/0/title": "Documented method options and alternatives", "/versions/20/tables/0/columns/0/label": "Option or term", "/versions/20/tables/0/columns/1/label": "Meaning", "/versions/20/tables/0/rows/0/description": "The method scram-sha-256 performs SCRAM-SHA-256 authentication, as described in RFC 7677 . It is a challenge-response scheme that prevents password sniffing on untrusted connections and supports storing passwords on the server in a cryptographically hashed form that is thought to be secure. This is the most secure of the currently provided methods, but it is not supported by older client libraries.", "/versions/20/tables/0/rows/1/description": "The method md5 uses a custom less secure challenge-response mechanism. It prevents password sniffing and avoids storing passwords on the server in plain text but provides no protection if an attacker manages to steal the password hash from the server. Also, the MD5 hash algorithm is nowadays no longer considered secure against determined attacks. To ease transition from the md5 method to the newer SCRAM method, if md5 is specified as a method in pg_hba.conf but the user's password on the server is encrypted for SCRAM (see below), then SCRAM-based authentication will automatically be chosen instead. Warning Support for MD5-encrypted passwords is deprecated and will be removed in a future release of PostgreSQL . Refer to the text below for details about migrating to another password type.", "/versions/20/tables/0/rows/2/description": "The method password sends the password in clear-text and is therefore vulnerable to password \u201c sniffing \u201d attacks. It should always be avoided if possible. If the connection is protected by SSL encryption then password can be used safely, though. (Though SSL certificate authentication might be a better choice if one is depending on using SSL)."}, "fallback_fields": [], "source_language": "en", "original_snapshot_sha256": "1f57e64a41ebcd12ddb431a793f5e4744e71c6815d2a04c178cdeb40b6b6a6f8"}, "comparison_data": {"method": "password", "documented_option_names": ["md5", "password", "scram-sha-256"]}, "comparison_hash": "d4a07ed4f297699ecd061181bcc656e57ea443c94b1d7536a172c08865099daf", "manual_language": "zh"}}}, "snapshot": {"facts": [{"label": "\u65b9\u6cd5", "value": "password"}, {"label": "\u914d\u7f6e", "value": "pg_hba.conf"}, {"label": "\u6e05\u5355", "value": "\u7528\u6237\u53ef\u89c1\u7684\u6e90\u7801\u8ba4\u8bc1\u65b9\u6cd5"}], "tables": [{"key": "method-options", "rows": [{"name": "scram-sha-256", "description": "scram-sha-256 \u65b9\u6cd5\u6267\u884c SCRAM-SHA-256 \u8ba4\u8bc1\uff0c\u5176\u5b9a\u4e49\u89c1 RFC 7677 \u3002\u5b83\u662f\u4e00\u79cd\u6311\u6218-\u54cd\u5e94\u65b9\u6848\uff0c\u53ef\u9632\u6b62\u5728\u4e0d\u53d7\u4fe1\u4efb\u8fde\u63a5\u4e0a\u55c5\u63a2\u5bc6\u7801\uff0c\u5e76\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u88ab\u8ba4\u4e3a\u5b89\u5168\u7684\u5bc6\u7801\u5b66 hash \u5f62\u5f0f\u5b58\u50a8\u5bc6\u7801\u3002 \u8fd9\u662f\u5f53\u524d\u63d0\u4f9b\u7684\u65b9\u6cd5\u4e2d\u6700\u5b89\u5168\u7684\u4e00\u79cd\uff0c\u4f46\u662f\u65e7\u7684\u5ba2\u6237\u7aef\u5e93\u4e0d\u652f\u6301\u8fd9\u79cd\u65b9\u6cd5\u3002"}, {"name": "md5", "description": "md5 \u65b9\u6cd5\u4f7f\u7528\u81ea\u5b9a\u4e49\u4e14\u5b89\u5168\u6027\u8f83\u5f31\u7684\u6311\u6218\u54cd\u5e94\u673a\u5236\u3002\u5b83\u80fd\u9632\u6b62\u5bc6\u7801\u55c5\u63a2\uff0c\u907f\u514d\u670d\u52a1\u5668\u660e\u6587\u5b58\u50a8\u5bc6\u7801\uff1b\u4f46\u653b\u51fb\u8005\u4e00\u65e6\u7a83\u53d6\u670d\u52a1\u5668\u4e0a\u7684\u5bc6\u7801\u54c8\u5e0c\uff0c\u5c31\u65e0\u6cd5\u63d0\u4f9b\u4fdd\u62a4\u3002\u6b64\u5916\uff0cMD5 \u54c8\u5e0c\u7b97\u6cd5\u5982\u4eca\u5df2\u4e0d\u518d\u88ab\u8ba4\u4e3a\u80fd\u5b89\u5168\u62b5\u5fa1\u6709\u9488\u5bf9\u6027\u7684\u653b\u51fb\u3002\u4e3a\u4fbf\u4e8e\u4ece md5 \u8fc1\u79fb\u5230\u8f83\u65b0\u7684 SCRAM \u65b9\u6cd5\uff0c\u5982\u679c pg_hba.conf \u4e2d\u6307\u5b9a md5\uff0c\u4f46\u670d\u52a1\u5668\u4e0a\u8be5\u7528\u6237\u7684\u5bc6\u7801\u91c7\u7528 SCRAM \u52a0\u5bc6\u5b58\u50a8\uff08\u89c1\u4e0b\u6587\uff09\uff0c\u7cfb\u7edf\u4f1a\u81ea\u52a8\u6539\u7528\u57fa\u4e8e SCRAM \u7684\u8ba4\u8bc1\u3002\u8b66\u544a\uff1a\u5bf9 MD5 \u52a0\u5bc6\u5bc6\u7801\u7684\u652f\u6301\u5df2\u5f03\u7528\uff0c\u5c06\u5728 PostgreSQL \u7684\u672a\u6765\u7248\u672c\u4e2d\u79fb\u9664\u3002\u8fc1\u79fb\u5230\u5176\u4ed6\u5bc6\u7801\u7c7b\u578b\u7684\u65b9\u6cd5\u53c2\u89c1\u4e0b\u6587\u3002"}, {"name": "password", "description": "\u65b9\u6cd5 password \u4ee5\u660e\u6587\u5f62\u5f0f\u53d1\u9001\u5bc6\u7801\uff0c\u56e0\u6b64\u5b83\u5bb9\u6613\u53d7\u5230\u5bc6\u7801 \u201c \u55c5\u63a2 \u201d \u653b\u51fb\u3002\u5982\u679c\u53ef\u80fd\u5e94\u8be5\u5c3d\u91cf\u907f\u514d\u4f7f\u7528\u5b83\u3002\u4e0d\u8fc7\uff0c\u5982\u679c\u8fde\u63a5\u88abSSL\u52a0\u5bc6\u4fdd\u62a4\u7740\uff0c\u90a3\u4e48\u53ef\u4ee5\u5b89\u5168\u5730\u4f7f\u7528 password \uff08\u4e0d\u8fc7\u5982\u679c\u4f9d\u9760SSL\uff0cSSL\u8bc1\u4e66\u8ba4\u8bc1\u53ef\u80fd\u662f\u66f4\u597d\u7684\u9009\u62e9\uff09\u3002"}], "title": "\u624b\u518c\u4e2d\u7684\u65b9\u6cd5\u9009\u9879\u4e0e\u66ff\u4ee3\u65b9\u5f0f", "columns": [{"key": "name", "label": "\u9009\u9879\u6216\u672f\u8bed"}, {"key": "description", "label": "\u542b\u4e49"}]}], "aliases": [], "related": [], "release": {"ref": "https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2", "label": "18.6", "major": "18", "channel": "stable", "revision": "555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f", "source_sha256": "555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f", "catalog_fingerprint": "65c93d6048ef30e61023a84f9680fa6a92b1c383b7eb226741170077eb078502"}, "sources": [{"url": "https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2", "label": "Matching PostgreSQL source archive", "sha256": "555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f"}, {"url": "https://pg.center/docs/18/auth-password.html", "path": "auth-password.html", "label": "PostgreSQL 18 English manual", "sha256": "89d87aa104ffde4d6ddb753032794cc5924db149179845d97788e0999e0971c1", "language": "en", "original_url": "/docs/18/auth-password.html"}, {"url": "https://pg.center/docs/18/auth-pg-hba-conf.html", "path": "auth-pg-hba-conf.html", "label": "PostgreSQL 18 English manual", "sha256": "6340d4abea2e0a3482afc31bcd1599a0fa10dc28a6f1e05d79ba831e2dd0b4c9", "language": "en", "original_url": "/docs/18/auth-pg-hba-conf.html"}], "sections": [], "signature": "", "attributes": {"method": "password", "inventory": "User-visible source authentication method", "configuration": "pg_hba.conf"}, "description": ["\u8981\u6c42\u5ba2\u6237\u7aef\u63d0\u4f9b\u672a\u7ecf\u52a0\u5bc6\u7684\u5bc6\u7801\u8fdb\u884c\u8ba4\u8bc1\u3002\u7531\u4e8e\u5bc6\u7801\u901a\u8fc7\u7f51\u7edc\u660e\u6587\u4f20\u8f93\uff0c\u4e0d\u5e94\u5728\u4e0d\u53ef\u4fe1\u7f51\u7edc\u4e0a\u4f7f\u7528\u3002\u8be6\u60c5\u53c2\u89c1\u7b2c 20.5 \u8282\u3002"], "manual_html": "<div class=\"sect1\" id=\"AUTH-PASSWORD\">\n<div class=\"titlepage\">\n<div>\n<div>\n<h2 class=\"title\" lang=\"zh\">\n<div>\n<div>\n<h2 class=\"title\" style=\"clear: both\">20.5.\u00a0\u5bc6\u7801\u8ba4\u8bc1 </h2>\n</div>\n</div>\n</h2>\n</div>\n</div>\n</div>\n<p lang=\"zh\">\u6709\u51e0\u79cd\u57fa\u4e8e\u5bc6\u7801\u7684\u8ba4\u8bc1\u65b9\u6cd5\u3002\u8fd9\u4e9b\u65b9\u6cd5\u7684\u8fc7\u7a0b\u7c7b\u4f3c\uff0c\u4f46\u662f\u533a\u522b\u5728\u4e8e\u7528\u6237\u5bc6\u7801\u5982\u4f55\u5b58\u653e\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u53ca\u5ba2\u6237\u7aef\u63d0\u4f9b\u7684\u5bc6\u7801\u5982\u4f55\u901a\u8fc7\u8fde\u63a5\u53d1\u9001\u3002</p>\n<div class=\"variablelist\">\n<dl class=\"variablelist\">\n<dt><span class=\"term\"><code class=\"literal\">scram-sha-256</code></span></dt>\n<dd>\n<p lang=\"zh\"><code class=\"literal\">scram-sha-256</code> \u65b9\u6cd5\u6267\u884c SCRAM-SHA-256 \u8ba4\u8bc1\uff0c\u5176\u5b9a\u4e49\u89c1 <a class=\"ulink\" href=\"https://datatracker.ietf.org/doc/html/rfc7677\" target=\"_top\">RFC 7677</a>\u3002\u5b83\u662f\u4e00\u79cd\u6311\u6218-\u54cd\u5e94\u65b9\u6848\uff0c\u53ef\u9632\u6b62\u5728\u4e0d\u53d7\u4fe1\u4efb\u8fde\u63a5\u4e0a\u55c5\u63a2\u5bc6\u7801\uff0c\u5e76\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u88ab\u8ba4\u4e3a\u5b89\u5168\u7684\u5bc6\u7801\u5b66 hash \u5f62\u5f0f\u5b58\u50a8\u5bc6\u7801\u3002</p>\n<p lang=\"zh\">\u8fd9\u662f\u5f53\u524d\u63d0\u4f9b\u7684\u65b9\u6cd5\u4e2d\u6700\u5b89\u5168\u7684\u4e00\u79cd\uff0c\u4f46\u662f\u65e7\u7684\u5ba2\u6237\u7aef\u5e93\u4e0d\u652f\u6301\u8fd9\u79cd\u65b9\u6cd5\u3002</p>\n</dd>\n<dt><span class=\"term\"><code class=\"literal\">md5</code></span></dt>\n<dd>\n<p lang=\"zh\">\u65b9\u6cd5<code class=\"literal\">md5</code>\u4f7f\u7528\u4e00\u79cd\u81ea\u5b9a\u4e49\u7684\u3001\u5b89\u5168\u6027\u8f83\u4f4e\u7684\u6311\u6218-\u54cd\u5e94\u673a\u5236\u3002\u5b83\u80fd\u9632\u6b62\u5bc6\u7801\u55c5\u63a2\uff0c\u5e76\u907f\u514d\u5728\u670d\u52a1\u5668\u4e0a\u4ee5\u660e\u6587\u5b58\u50a8\u5bc6\u7801\uff1b\u4f46\u5982\u679c\u653b\u51fb\u8005\u8bbe\u6cd5\u4ece\u670d\u52a1\u5668\u4e0a\u7a83\u53d6\u4e86\u5bc6\u7801 hash\uff0c\u5b83\u5c31\u65e0\u6cd5\u63d0\u4f9b\u4fdd\u62a4\u3002\u6b64\u5916\uff0c\u5982\u4eca\u5df2\u4e0d\u518d\u8ba4\u4e3a MD5 hash \u7b97\u6cd5\u80fd\u62b5\u5fa1\u6709\u51b3\u5fc3\u7684\u653b\u51fb\u8005\u3002</p>\n<p lang=\"zh\">\u4e3a\u4fbf\u4e8e\u4ece md5 \u8fc1\u79fb\u5230\u8f83\u65b0\u7684 SCRAM \u65b9\u6cd5\uff0c\u5982\u679c pg_hba.conf \u4e2d\u6307\u5b9a md5\uff0c\u4f46\u670d\u52a1\u5668\u4e0a\u8be5\u7528\u6237\u7684\u5bc6\u7801\u91c7\u7528 SCRAM \u52a0\u5bc6\u5b58\u50a8\uff08\u89c1\u4e0b\u6587\uff09\uff0c\u7cfb\u7edf\u4f1a\u81ea\u52a8\u6539\u7528\u57fa\u4e8e SCRAM \u7684\u8ba4\u8bc1\u3002</p>\n<div class=\"warning\">\n<h3 class=\"title\" lang=\"zh\">\u8b66\u544a</h3>\n<p lang=\"zh\">\u5bf9 MD5 \u52a0\u5bc6\u5bc6\u7801\u7684\u652f\u6301\u5df2\u5f03\u7528\uff0c\u5e76\u5c06\u5728<span class=\"productname\">PostgreSQL</span>\u7684\u672a\u6765\u7248\u672c\u4e2d\u79fb\u9664\u3002\u8fc1\u79fb\u5230\u5176\u4ed6\u5bc6\u7801\u7c7b\u578b\u7684\u8be6\u7ec6\u4fe1\u606f\u89c1\u4e0b\u6587\u3002</p>\n</div>\n</dd>\n<dt><span class=\"term\"><code class=\"literal\">password</code></span></dt>\n<dd>\n<p lang=\"zh\">\n<p>\u65b9\u6cd5<code class=\"literal\">password</code>\u4ee5\u660e\u6587\u5f62\u5f0f\u53d1\u9001\u5bc6\u7801\uff0c\u56e0\u6b64\u5b83\u5bb9\u6613\u53d7\u5230\u5bc6\u7801<span class=\"quote\">\u201c<span class=\"quote\">\u55c5\u63a2</span>\u201d</span>\u653b\u51fb\u3002\u5982\u679c\u53ef\u80fd\u5e94\u8be5\u5c3d\u91cf\u907f\u514d\u4f7f\u7528\u5b83\u3002\u4e0d\u8fc7\uff0c\u5982\u679c\u8fde\u63a5\u88abSSL\u52a0\u5bc6\u4fdd\u62a4\u7740\uff0c\u90a3\u4e48\u53ef\u4ee5\u5b89\u5168\u5730\u4f7f\u7528<code class=\"literal\">password</code>\uff08\u4e0d\u8fc7\u5982\u679c\u4f9d\u9760SSL\uff0cSSL\u8bc1\u4e66\u8ba4\u8bc1\u53ef\u80fd\u662f\u66f4\u597d\u7684\u9009\u62e9\uff09\u3002</p>\n</p>\n</dd>\n</dl>\n</div>\n<p lang=\"zh\"><span class=\"productname\">PostgreSQL</span> \u6570\u636e\u5e93\u5bc6\u7801\u72ec\u7acb\u4e8e\u64cd\u4f5c\u7cfb\u7edf\u7528\u6237\u5bc6\u7801\u3002\u6bcf\u4e2a\u6570\u636e\u5e93\u7528\u6237\u7684\u5bc6\u7801\u90fd\u5b58\u50a8\u5728\u7cfb\u7edf\u76ee\u5f55 <code class=\"literal\">pg_authid</code> \u4e2d\u3002\u5bc6\u7801\u53ef\u4ee5\u901a\u8fc7 SQL \u547d\u4ee4<a class=\"xref\" href=\"/docs/18/sql-createrole.html\" title=\"CREATE ROLE\"><span class=\"refentrytitle\">CREATE ROLE</span></a>\u548c<a class=\"xref\" href=\"/docs/18/sql-alterrole.html\" title=\"ALTER ROLE\"><span class=\"refentrytitle\">ALTER ROLE</span></a>\u7ba1\u7406\uff0c\u4f8b\u5982 <strong class=\"userinput\"><code>CREATE ROLE foo WITH LOGIN PASSWORD 'secret'</code></strong>\uff0c\u6216\u8005\u901a\u8fc7 <span class=\"application\">psql</span> \u7684 <code class=\"literal\">\\password</code> \u547d\u4ee4\u7ba1\u7406\u3002\u5982\u679c\u67d0\u4e2a\u7528\u6237\u6ca1\u6709\u8bbe\u7f6e\u5bc6\u7801\uff0c\u5219\u5176\u5b58\u50a8\u5bc6\u7801\u4e3a null\uff0c\u8be5\u7528\u6237\u7684\u5bc6\u7801\u8ba4\u8bc1\u5c06\u59cb\u7ec8\u5931\u8d25\u3002</p>\n<p lang=\"zh\">\u4e0d\u540c\u57fa\u4e8e\u5bc6\u7801\u7684\u8ba4\u8bc1\u65b9\u6cd5\u662f\u5426\u53ef\u7528\uff0c\u53d6\u51b3\u4e8e\u7528\u6237\u5728\u670d\u52a1\u5668\u4e0a\u7684\u5bc6\u7801\u662f\u5982\u4f55\u52a0\u5bc6\u7684\uff08\u66f4\u51c6\u786e\u5730\u8bf4\uff0c\u662f\u5982\u4f55\u8fdb\u884c hash \u8fd0\u7b97\u7684\uff09\u3002\u8fd9\u7531\u8bbe\u7f6e\u5bc6\u7801\u65f6\u7684\u914d\u7f6e\u53c2\u6570<a class=\"xref\" href=\"/docs/18/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION\">password_encryption</a>\u63a7\u5236\u3002\u5982\u679c\u5bc6\u7801\u662f\u4f7f\u7528 <code class=\"literal\">scram-sha-256</code> \u8bbe\u7f6e\u52a0\u5bc6\u7684\uff0c\u90a3\u4e48\u5b83\u53ef\u4ee5\u7528\u4e8e <code class=\"literal\">scram-sha-256</code> \u548c <code class=\"literal\">password</code> \u8ba4\u8bc1\u65b9\u6cd5\uff08\u4f46\u540e\u4e00\u79cd\u60c5\u51b5\u4e0b\u5bc6\u7801\u4f1a\u4ee5\u660e\u6587\u4f20\u8f93\uff09\u3002\u5982\u4e0a\u6240\u8ff0\uff0c\u6b64\u65f6\u5982\u679c\u8ba4\u8bc1\u65b9\u6cd5\u6307\u5b9a\u4e3a <code class=\"literal\">md5</code>\uff0c\u4e5f\u4f1a\u81ea\u52a8\u5207\u6362\u4e3a\u4f7f\u7528 <code class=\"literal\">scram-sha-256</code>\uff0c\u56e0\u6b64\u540c\u6837\u80fd\u591f\u5de5\u4f5c\u3002\u5982\u679c\u5bc6\u7801\u662f\u4f7f\u7528 <code class=\"literal\">md5</code> \u8bbe\u7f6e\u52a0\u5bc6\u7684\uff0c\u90a3\u4e48\u5b83\u53ea\u80fd\u7528\u4e8e <code class=\"literal\">md5</code> \u548c <code class=\"literal\">password</code> \u8ba4\u8bc1\u65b9\u6cd5\uff08\u540c\u6837\uff0c\u540e\u4e00\u79cd\u60c5\u51b5\u4e0b\u5bc6\u7801\u4f1a\u4ee5\u660e\u6587\u4f20\u8f93\uff09\u3002\uff08\u4ee5\u524d\u7684 PostgreSQL \u7248\u672c\u652f\u6301\u5728\u670d\u52a1\u5668\u4e0a\u5b58\u50a8\u660e\u6587\u5bc6\u7801\uff0c\u4f46\u73b0\u5728\u5df2\u7ecf\u4e0d\u518d\u53ef\u80fd\u3002\uff09\u8981\u68c0\u67e5\u5f53\u524d\u5b58\u50a8\u7684\u5bc6\u7801 hash\uff0c\u53ef\u4ee5\u67e5\u770b\u7cfb\u7edf\u76ee\u5f55 <code class=\"literal\">pg_authid</code>\u3002</p>\n<p lang=\"zh\">\u8981\u5c06\u73b0\u6709\u5b89\u88c5\u4ece md5 \u5347\u7ea7\u5230 scram-sha-256\uff0c\u5e94\u5148\u786e\u8ba4\u6240\u6709\u4f7f\u7528\u4e2d\u7684\u5ba2\u6237\u7aef\u5e93\u7248\u672c\u90fd\u652f\u6301 SCRAM\uff1b\u7136\u540e\u5728 postgresql.conf \u4e2d\u8bbe\u7f6e password_encryption = 'scram-sha-256'\uff0c\u8ba9\u6240\u6709\u7528\u6237\u91cd\u65b0\u8bbe\u7f6e\u5bc6\u7801\uff0c\u5e76\u5c06 pg_hba.conf \u4e2d\u7684\u8ba4\u8bc1\u65b9\u6cd5\u6539\u4e3a scram-sha-256\u3002</p>\n</div>", "manual_path": "/docs/18/auth-password.html", "localization": {"status": "complete", "sources": [{"url": "/docs/18/auth-password.html", "method": "same-major semantic node", "sha256": "033ef5142713a61e9d92f15f25197231bf458e50f7e8c2fefaca46c0f070aab0", "language": "zh", "matched_nodes": ["#AUTH-PASSWORD/div[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]/p[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[1]/p[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[3]/div[2]/h3[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[3]/div[2]/p[1]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[3]/p[0]", "#AUTH-PASSWORD/div[5]/dl[0]/dd[5]", "#AUTH-PASSWORD/p[4]", "#AUTH-PASSWORD/p[6]", "#AUTH-PASSWORD/p[7]"]}], "language": "zh", "original_text": {"/versions/18/description/0": "Require the client to supply an unencrypted password for authentication. Since the password is sent in clear text over the network, this should not be used on untrusted networks. See Section 20.5 for details.", "/versions/18/facts/0/label": "Method", "/versions/18/facts/1/label": "Configuration", "/versions/18/facts/2/label": "Inventory", "/versions/18/facts/2/value": "User-visible source authentication method", "/versions/18/tables/0/title": "Documented method options and alternatives", "/versions/18/tables/0/columns/0/label": "Option or term", "/versions/18/tables/0/columns/1/label": "Meaning", "/versions/18/tables/0/rows/0/description": "The method scram-sha-256 performs SCRAM-SHA-256 authentication, as described in RFC 7677 . It is a challenge-response scheme that prevents password sniffing on untrusted connections and supports storing passwords on the server in a cryptographically hashed form that is thought to be secure. This is the most secure of the currently provided methods, but it is not supported by older client libraries.", "/versions/18/tables/0/rows/1/description": "The method md5 uses a custom less secure challenge-response mechanism. It prevents password sniffing and avoids storing passwords on the server in plain text but provides no protection if an attacker manages to steal the password hash from the server. Also, the MD5 hash algorithm is nowadays no longer considered secure against determined attacks. To ease transition from the md5 method to the newer SCRAM method, if md5 is specified as a method in pg_hba.conf but the user's password on the server is encrypted for SCRAM (see below), then SCRAM-based authentication will automatically be chosen instead. Warning Support for MD5-encrypted passwords is deprecated and will be removed in a future release of PostgreSQL . Refer to the text below for details about migrating to another password type.", "/versions/18/tables/0/rows/2/description": "The method password sends the password in clear-text and is therefore vulnerable to password \u201c sniffing \u201d attacks. It should always be avoided if possible. If the connection is protected by SSL encryption then password can be used safely, though. (Though SSL certificate authentication might be a better choice if one is depending on using SSL)."}, "fallback_fields": [], "source_language": "en", "original_snapshot_sha256": "32dad5a7f1ee673f3116584aa42bb3fea9d3cdacabadd392d1b3a4c9ea708622"}, "comparison_data": {"method": "password", "documented_option_names": ["md5", "password", "scram-sha-256"]}, "comparison_hash": "d4a07ed4f297699ecd061181bcc656e57ea443c94b1d7536a172c08865099daf", "manual_language": "zh"}, "comparison": {"left": "17", "right": "18", "status": "unchanged", "diff": ""}}