Skip to content

Commit cc7a484

Browse files
yosifkityosifkit
committed
Error when POSTGRES_PASSWORD is unset like mysql
Add POSTGRES_HOST_AUTH_METHOD to bring back old behavior and be similar to MYSQL_ALLOW_EMPTY_PASSWORD, but add warning when "trust" is used since it disables all passwords
1 parent 0d0485c commit cc7a484

13 files changed

+520
-273
lines changed

‎10/alpine/docker-entrypoint.sh

+40-21
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,10 @@ docker_init_database_dir() {
8787
fi
8888
}
8989

90-
# print large warning if POSTGRES_PASSWORD is empty
90+
# print large warning if POSTGRES_PASSWORD is long
91+
# error if both POSTGRES_PASSWORD is unset and POSTGRES_HOST_AUTH_METHOD is not 'trust'
92+
# print large warning if POSTGRES_HOST_AUTH_METHOD is set to 'trust'
93+
# assumes database is not set up, ie: [ -z "$DATABASE_ALREADY_EXISTS" ]
9194
docker_verify_minimum_env() {
9295
# check password first so we can output the warning before postgres
9396
# messes it up
@@ -103,22 +106,37 @@ docker_verify_minimum_env() {
103106
104107
EOWARN
105108
fi
106-
if [ -z "$POSTGRES_PASSWORD" ]; then
109+
if [ -z "$POSTGRES_PASSWORD" ] && [ 'trust' != "$POSTGRES_HOST_AUTH_METHOD" ]; then
107110
# The - option suppresses leading tabs but *not* spaces. :)
111+
cat >&2 <<-'EOE'
112+
Error: Database is uninitialized and superuser password is not specified.
113+
You must specify POSTGRES_PASSWORD for the superuser. Use
114+
"-e POSTGRES_PASSWORD=password" to set it in "docker run".
115+
116+
You may also use POSTGRES_HOST_AUTH_METHOD=trust to allow all connections
117+
without a password. This is *not* recommended. See PostgreSQL
118+
documentation about "trust":
119+
https://www.postgresql.org/docs/current/auth-trust.html
120+
121+
EOE
122+
exit 1
123+
fi
124+
if [ 'trust' = "$POSTGRES_HOST_AUTH_METHOD" ]; then
108125
cat >&2 <<-'EOWARN'
109-
****************************************************
110-
WARNING: No password has been set for the database.
111-
This will allow anyone with access to the
112-
Postgres port to access your database. In
113-
Docker's default configuration, this is
114-
effectively any other container on the same
115-
system.
116-
117-
Use "-e POSTGRES_PASSWORD=password" to set
118-
it in "docker run".
119-
****************************************************
126+
********************************************************************************
127+
WARNING: POSTGRES_HOST_AUTH_METHOD has been set to "trust". This will allow
128+
anyone with access to the Postgres port to access your database without
129+
a password, even if POSTGRES_PASSWORD is set. See PostgreSQL
130+
documentation about "trust":
131+
https://www.postgresql.org/docs/current/auth-trust.html
132+
In Docker's default configuration, this is effectively any other
133+
container on the same system.
134+
135+
It is not recommended to use POSTGRES_HOST_AUTH_METHOD=trust. Replace
136+
it with "-e POSTGRES_PASSWORD=password" instead to set a password in
137+
"docker run".
138+
********************************************************************************
120139
EOWARN
121-
122140
fi
123141
}
124142

@@ -185,6 +203,8 @@ docker_setup_env() {
185203
file_env 'POSTGRES_USER' 'postgres'
186204
file_env 'POSTGRES_DB' "$POSTGRES_USER"
187205
file_env 'POSTGRES_INITDB_ARGS'
206+
# default authentication method is md5
207+
: "${POSTGRES_HOST_AUTH_METHOD:=md5}"
188208

189209
declare -g DATABASE_ALREADY_EXISTS
190210
# look specifically for PG_VERSION, as it is expected in the DB dir
@@ -193,16 +213,15 @@ docker_setup_env() {
193213
fi
194214
}
195215

196-
# append md5 or trust auth to pg_hba.conf based on existence of POSTGRES_PASSWORD
216+
# append POSTGRES_HOST_AUTH_METHOD to pg_hba.conf for "host" connections
197217
pg_setup_hba_conf() {
198-
local authMethod='md5'
199-
if [ -z "$POSTGRES_PASSWORD" ]; then
200-
authMethod='trust'
201-
fi
202-
203218
{
204219
echo
205-
echo "host all all all $authMethod"
220+
if [ 'trust' = "$POSTGRES_HOST_AUTH_METHOD" ]; then
221+
echo '# warning trust is enabled for all connections'
222+
echo '# see https://www.postgresql.org/docs/12/auth-trust.html'
223+
fi
224+
echo "host all all all $POSTGRES_HOST_AUTH_METHOD"
206225
} >> "$PGDATA/pg_hba.conf"
207226
}
208227

‎10/docker-entrypoint.sh

+40-21
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,10 @@ docker_init_database_dir() {
8787
fi
8888
}
8989

90-
# print large warning if POSTGRES_PASSWORD is empty
90+
# print large warning if POSTGRES_PASSWORD is long
91+
# error if both POSTGRES_PASSWORD is unset and POSTGRES_HOST_AUTH_METHOD is not 'trust'
92+
# print large warning if POSTGRES_HOST_AUTH_METHOD is set to 'trust'
93+
# assumes database is not set up, ie: [ -z "$DATABASE_ALREADY_EXISTS" ]
9194
docker_verify_minimum_env() {
9295
# check password first so we can output the warning before postgres
9396
# messes it up
@@ -103,22 +106,37 @@ docker_verify_minimum_env() {
103106
104107
EOWARN
105108
fi
106-
if [ -z "$POSTGRES_PASSWORD" ]; then
109+
if [ -z "$POSTGRES_PASSWORD" ] && [ 'trust' != "$POSTGRES_HOST_AUTH_METHOD" ]; then
107110
# The - option suppresses leading tabs but *not* spaces. :)
111+
cat >&2 <<-'EOE'
112+
Error: Database is uninitialized and superuser password is not specified.
113+
You must specify POSTGRES_PASSWORD for the superuser. Use
114+
"-e POSTGRES_PASSWORD=password" to set it in "docker run".
115+
116+
You may also use POSTGRES_HOST_AUTH_METHOD=trust to allow all connections
117+
without a password. This is *not* recommended. See PostgreSQL
118+
documentation about "trust":
119+
https://www.postgresql.org/docs/current/auth-trust.html
120+
121+
EOE
122+
exit 1
123+
fi
124+
if [ 'trust' = "$POSTGRES_HOST_AUTH_METHOD" ]; then
108125
cat >&2 <<-'EOWARN'
109-
****************************************************
110-
WARNING: No password has been set for the database.
111-
This will allow anyone with access to the
112-
Postgres port to access your database. In
113-
Docker's default configuration, this is
114-
effectively any other container on the same
115-
system.
116-
117-
Use "-e POSTGRES_PASSWORD=password" to set
118-
it in "docker run".
119-
****************************************************
126+
********************************************************************************
127+
WARNING: POSTGRES_HOST_AUTH_METHOD has been set to "trust". This will allow
128+
anyone with access to the Postgres port to access your database without
129+
a password, even if POSTGRES_PASSWORD is set. See PostgreSQL
130+
documentation about "trust":
131+
https://www.postgresql.org/docs/current/auth-trust.html
132+
In Docker's default configuration, this is effectively any other
133+
container on the same system.
134+
135+
It is not recommended to use POSTGRES_HOST_AUTH_METHOD=trust. Replace
136+
it with "-e POSTGRES_PASSWORD=password" instead to set a password in
137+
"docker run".
138+
********************************************************************************
120139
EOWARN
121-
122140
fi
123141
}
124142

@@ -185,6 +203,8 @@ docker_setup_env() {
185203
file_env 'POSTGRES_USER' 'postgres'
186204
file_env 'POSTGRES_DB' "$POSTGRES_USER"
187205
file_env 'POSTGRES_INITDB_ARGS'
206+
# default authentication method is md5
207+
: "${POSTGRES_HOST_AUTH_METHOD:=md5}"
188208

189209
declare -g DATABASE_ALREADY_EXISTS
190210
# look specifically for PG_VERSION, as it is expected in the DB dir
@@ -193,16 +213,15 @@ docker_setup_env() {
193213
fi
194214
}
195215

196-
# append md5 or trust auth to pg_hba.conf based on existence of POSTGRES_PASSWORD
216+
# append POSTGRES_HOST_AUTH_METHOD to pg_hba.conf for "host" connections
197217
pg_setup_hba_conf() {
198-
local authMethod='md5'
199-
if [ -z "$POSTGRES_PASSWORD" ]; then
200-
authMethod='trust'
201-
fi
202-
203218
{
204219
echo
205-
echo "host all all all $authMethod"
220+
if [ 'trust' = "$POSTGRES_HOST_AUTH_METHOD" ]; then
221+
echo '# warning trust is enabled for all connections'
222+
echo '# see https://www.postgresql.org/docs/12/auth-trust.html'
223+
fi
224+
echo "host all all all $POSTGRES_HOST_AUTH_METHOD"
206225
} >> "$PGDATA/pg_hba.conf"
207226
}
208227

‎11/alpine/docker-entrypoint.sh

+40-21
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,10 @@ docker_init_database_dir() {
8787
fi
8888
}
8989

90-
# print large warning if POSTGRES_PASSWORD is empty
90+
# print large warning if POSTGRES_PASSWORD is long
91+
# error if both POSTGRES_PASSWORD is unset and POSTGRES_HOST_AUTH_METHOD is not 'trust'
92+
# print large warning if POSTGRES_HOST_AUTH_METHOD is set to 'trust'
93+
# assumes database is not set up, ie: [ -z "$DATABASE_ALREADY_EXISTS" ]
9194
docker_verify_minimum_env() {
9295
# check password first so we can output the warning before postgres
9396
# messes it up
@@ -103,22 +106,37 @@ docker_verify_minimum_env() {
103106
104107
EOWARN
105108
fi
106-
if [ -z "$POSTGRES_PASSWORD" ]; then
109+
if [ -z "$POSTGRES_PASSWORD" ] && [ 'trust' != "$POSTGRES_HOST_AUTH_METHOD" ]; then
107110
# The - option suppresses leading tabs but *not* spaces. :)
111+
cat >&2 <<-'EOE'
112+
Error: Database is uninitialized and superuser password is not specified.
113+
You must specify POSTGRES_PASSWORD for the superuser. Use
114+
"-e POSTGRES_PASSWORD=password" to set it in "docker run".
115+
116+
You may also use POSTGRES_HOST_AUTH_METHOD=trust to allow all connections
117+
without a password. This is *not* recommended. See PostgreSQL
118+
documentation about "trust":
119+
https://www.postgresql.org/docs/current/auth-trust.html
120+
121+
EOE
122+
exit 1
123+
fi
124+
if [ 'trust' = "$POSTGRES_HOST_AUTH_METHOD" ]; then
108125
cat >&2 <<-'EOWARN'
109-
****************************************************
110-
WARNING: No password has been set for the database.
111-
This will allow anyone with access to the
112-
Postgres port to access your database. In
113-
Docker's default configuration, this is
114-
effectively any other container on the same
115-
system.
116-
117-
Use "-e POSTGRES_PASSWORD=password" to set
118-
it in "docker run".
119-
****************************************************
126+
********************************************************************************
127+
WARNING: POSTGRES_HOST_AUTH_METHOD has been set to "trust". This will allow
128+
anyone with access to the Postgres port to access your database without
129+
a password, even if POSTGRES_PASSWORD is set. See PostgreSQL
130+
documentation about "trust":
131+
https://www.postgresql.org/docs/current/auth-trust.html
132+
In Docker's default configuration, this is effectively any other
133+
container on the same system.
134+
135+
It is not recommended to use POSTGRES_HOST_AUTH_METHOD=trust. Replace
136+
it with "-e POSTGRES_PASSWORD=password" instead to set a password in
137+
"docker run".
138+
********************************************************************************
120139
EOWARN
121-
122140
fi
123141
}
124142

@@ -185,6 +203,8 @@ docker_setup_env() {
185203
file_env 'POSTGRES_USER' 'postgres'
186204
file_env 'POSTGRES_DB' "$POSTGRES_USER"
187205
file_env 'POSTGRES_INITDB_ARGS'
206+
# default authentication method is md5
207+
: "${POSTGRES_HOST_AUTH_METHOD:=md5}"
188208

189209
declare -g DATABASE_ALREADY_EXISTS
190210
# look specifically for PG_VERSION, as it is expected in the DB dir
@@ -193,16 +213,15 @@ docker_setup_env() {
193213
fi
194214
}
195215

196-
# append md5 or trust auth to pg_hba.conf based on existence of POSTGRES_PASSWORD
216+
# append POSTGRES_HOST_AUTH_METHOD to pg_hba.conf for "host" connections
197217
pg_setup_hba_conf() {
198-
local authMethod='md5'
199-
if [ -z "$POSTGRES_PASSWORD" ]; then
200-
authMethod='trust'
201-
fi
202-
203218
{
204219
echo
205-
echo "host all all all $authMethod"
220+
if [ 'trust' = "$POSTGRES_HOST_AUTH_METHOD" ]; then
221+
echo '# warning trust is enabled for all connections'
222+
echo '# see https://www.postgresql.org/docs/12/auth-trust.html'
223+
fi
224+
echo "host all all all $POSTGRES_HOST_AUTH_METHOD"
206225
} >> "$PGDATA/pg_hba.conf"
207226
}
208227

‎11/docker-entrypoint.sh

+40-21
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,10 @@ docker_init_database_dir() {
8787
fi
8888
}
8989

90-
# print large warning if POSTGRES_PASSWORD is empty
90+
# print large warning if POSTGRES_PASSWORD is long
91+
# error if both POSTGRES_PASSWORD is unset and POSTGRES_HOST_AUTH_METHOD is not 'trust'
92+
# print large warning if POSTGRES_HOST_AUTH_METHOD is set to 'trust'
93+
# assumes database is not set up, ie: [ -z "$DATABASE_ALREADY_EXISTS" ]
9194
docker_verify_minimum_env() {
9295
# check password first so we can output the warning before postgres
9396
# messes it up
@@ -103,22 +106,37 @@ docker_verify_minimum_env() {
103106
104107
EOWARN
105108
fi
106-
if [ -z "$POSTGRES_PASSWORD" ]; then
109+
if [ -z "$POSTGRES_PASSWORD" ] && [ 'trust' != "$POSTGRES_HOST_AUTH_METHOD" ]; then
107110
# The - option suppresses leading tabs but *not* spaces. :)
111+
cat >&2 <<-'EOE'
112+
Error: Database is uninitialized and superuser password is not specified.
113+
You must specify POSTGRES_PASSWORD for the superuser. Use
114+
"-e POSTGRES_PASSWORD=password" to set it in "docker run".
115+
116+
You may also use POSTGRES_HOST_AUTH_METHOD=trust to allow all connections
117+
without a password. This is *not* recommended. See PostgreSQL
118+
documentation about "trust":
119+
https://www.postgresql.org/docs/current/auth-trust.html
120+
121+
EOE
122+
exit 1
123+
fi
124+
if [ 'trust' = "$POSTGRES_HOST_AUTH_METHOD" ]; then
108125
cat >&2 <<-'EOWARN'
109-
****************************************************
110-
WARNING: No password has been set for the database.
111-
This will allow anyone with access to the
112-
Postgres port to access your database. In
113-
Docker's default configuration, this is
114-
effectively any other container on the same
115-
system.
116-
117-
Use "-e POSTGRES_PASSWORD=password" to set
118-
it in "docker run".
119-
****************************************************
126+
********************************************************************************
127+
WARNING: POSTGRES_HOST_AUTH_METHOD has been set to "trust". This will allow
128+
anyone with access to the Postgres port to access your database without
129+
a password, even if POSTGRES_PASSWORD is set. See PostgreSQL
130+
documentation about "trust":
131+
https://www.postgresql.org/docs/current/auth-trust.html
132+
In Docker's default configuration, this is effectively any other
133+
container on the same system.
134+
135+
It is not recommended to use POSTGRES_HOST_AUTH_METHOD=trust. Replace
136+
it with "-e POSTGRES_PASSWORD=password" instead to set a password in
137+
"docker run".
138+
********************************************************************************
120139
EOWARN
121-
122140
fi
123141
}
124142

@@ -185,6 +203,8 @@ docker_setup_env() {
185203
file_env 'POSTGRES_USER' 'postgres'
186204
file_env 'POSTGRES_DB' "$POSTGRES_USER"
187205
file_env 'POSTGRES_INITDB_ARGS'
206+
# default authentication method is md5
207+
: "${POSTGRES_HOST_AUTH_METHOD:=md5}"
188208

189209
declare -g DATABASE_ALREADY_EXISTS
190210
# look specifically for PG_VERSION, as it is expected in the DB dir
@@ -193,16 +213,15 @@ docker_setup_env() {
193213
fi
194214
}
195215

196-
# append md5 or trust auth to pg_hba.conf based on existence of POSTGRES_PASSWORD
216+
# append POSTGRES_HOST_AUTH_METHOD to pg_hba.conf for "host" connections
197217
pg_setup_hba_conf() {
198-
local authMethod='md5'
199-
if [ -z "$POSTGRES_PASSWORD" ]; then
200-
authMethod='trust'
201-
fi
202-
203218
{
204219
echo
205-
echo "host all all all $authMethod"
220+
if [ 'trust' = "$POSTGRES_HOST_AUTH_METHOD" ]; then
221+
echo '# warning trust is enabled for all connections'
222+
echo '# see https://www.postgresql.org/docs/12/auth-trust.html'
223+
fi
224+
echo "host all all all $POSTGRES_HOST_AUTH_METHOD"
206225
} >> "$PGDATA/pg_hba.conf"
207226
}
208227

0 commit comments

Comments
 (0)