This bulletin announces a minor update in our database authentication systems. Effective from $MIGRATION_START_DATE, Scalingo will be migrating the password hashing algorithm for existing PostgreSQL databases from MD5 to SCRAM (Salted Challenge Response Authentication Mechanism).

PostgreSQL databases created after the 20th of December 2023 already use SCRAM-SHA-256 as the default authentication method.

The MD5 hashing algorithm was the de facto standard when we started offering Database-As-A-Service in 2014. Nowadays it is considered insecure, because in the unlikely event a database breach, an attacker could use the hashes to infer the original passwords (using a technique called rainbow tables).

As part of our ongoing efforts to enhance security and provide the best possible service to our customers, we will update the password hashing algorithm from MD5 to SCRAM-SHA-256.

Quote from the PostgreSQL documentation:

The method scram-sha-256 performs SCRAM-SHA-256 authentication, as described in RFC 7677. It is a challenge-response scheme that prevents password sniffing on untrusted connections and supports storing passwords on the server in a cryptographically hashed form that is thought to be secure. This is the most secure of the currently provided methods, but it is not supported by older client libraries.

This is a per-database-user change. It implies resetting the users’ passwords (since PostgreSQL doesn’t know them).

Timeline of the rollout

There are 2 distinct timelines, depending on the type of the parent application of the PostgreSQL add-on.

• Health Data Hosting databases (HDH): for PostgreSQL add-ons linked to HDH applications, this update is scheduled for $MIGRATION_START_DATE+2_MONTHS (in 2 months’ time). This notice is due to the nature of the data contained in these databases and the excessive caution they require.
• Other databases: this change will be applied automatically in the coming weeks.

You will be notified by e-mail 24 hours before the start of the maintenance period of the affected add-on(s), according to the database maintenance window configuration.

Impact on your applications

Rest assured, this transition is designed to have minimal impact on your applications (less than a second). The connections to the database will remain active and there is no need to restart your application. Furthermore, the SCRAM-SHA-256 algorithm is widely supported by PostgreSQL clients library and has been in use for several years.

To ensure a smooth transition, we kindly request that you verify that your PostgreSQL client version supports the SCRAM-SHA-256 algorithm. You can refer to the PostgreSQL Wiki for the list of compatible client library versions.

Application of this change

As PostgreSQL only stores a hash of the password, changing the hashing algorithm implies that we provide the original password again to the database. This is only possible for users that are managed by Scalingo (the protected users in your database dashboard).

Protected users

Protected users are credentials created automatically by Scalingo to allow applications to connect to databases.

As we manage the passwords for these users, we will be able to update the passwords automatically.

All protected users in your PostgreSQL databases hosted on Scalingo will automatically be migrated to use SCRAM authentication.

Unmanaged users

Unmanaged users of your database won’t be migrated as we don’t have their passwords. There is no difference between users created via the CLI or the database dashboard.

After the update is finished, you will be able to change the password of any other unmanaged users to use the SCRAM-SHA-256 authentication method.

Use the Scalingo CLI (version 1.31.0 and later) to identify unmanaged users of your database. In order to upgrade the hash algorithm and authentication method, you will simply need to update or reset their passwords.

$ scalingo --app my-app --addon <addon uuid> database-users-list
+----------------+-----------+-----------+---------------------+
|    USERNAME    | READ-ONLY | PROTECTED | PASSWORD ENCRYPTION |
+----------------+-----------+-----------+---------------------+
| proddb_4794    | false     | true      | SCRAM-SHA-256       |
| myuser         | false     | false     | MD5                 |
+----------------+-----------+-----------+---------------------+

For each manually created user using MD5 authentication method, run the following command. A prompt will ask for your password, you can either re-enter the current one or update it to a new value:

$ scalingo --app my-app --addon <addon uuid> database-user-update-password <username>

By listing the users in your database again, you will be able to confirm the change of algorithm.

How can I be sure that my application is compatible with SCRAM-SHA-256?

The best way to check this change, without affecting your application, is to create a new app with the same source code and add a new PostgreSQL add-on. You can then import some sample data and assess the compatibility with your client library.

To help you identify the connection method used when establishing a connection to your database, we have made this information visible in our API and CLI (version 1.31.0 and later). For more information, please consult our documentation.

I would like to apply this change faster (HDH add-ons only)

If your HDH application is already fully compatible with SCRAM-SHA-256 and you wish to apply this security enhancement without waiting for 2 months, please contact our support team by chat or e-mail. Provide us with the names of the databases you wish to update and we will do the rest!

I would like to postpone this maintenance for more than 2 months (HDH add-ons only)

While not recommended, if you would like to defer this maintenance for more than 2 months for your HDH applications, please contact our support team.

Final words

The migration from MD5 to SCRAM is a necessary security enhancement. SCRAM is a more secure and modern authentication method that provides better protection against several types of attacks, including brute force and rainbow table attacks. This change is in line with industry best practices and recommendations for database security.

Be sure to check if some of your custom database users are using MD5, and change their passwords in order to update the hash algorithm.

Scalingo is committed to maintain the highest standards of security and service for our customers. We appreciate your cooperation and understanding in this important security enhancement.

Timeline

• 2024-05-07: Announcement and detailed information provided to customers.
• 2024-05-13: Start of the automatic migration of all non-HDH databases to SCRAM authentication.
• 2024-07-08: Start of the automatic migration of all HDH databases to SCRAM authentication.

Changelog

2024-05-06 : Initial version