Update password creation to be scram-sha-256 instead of md5 (#1119)

* changes to pgbouncer for FIPS

* change passwords creation to be scram, add some tests

* changes to makefile and to docker compose

Author: angeloskyratzakos

Makefile

@@ -132,7 +132,7 @@ goformat:
 
 .PHONY: dev-start
 dev-start:
-	docker-compose up -d
+	docker compose up -d
 
 ## Checks if imports are formatted correctly.
 .PHONY: goimports

docker-compose.yml

@@ -1,4 +1,3 @@
-version: "3.7"
 services:
   postgres:
     image: "postgres:14.8"
@@ -24,4 +23,4 @@ networks:
         # used by Tailscale on Linux. Tailscale's use of these addresses
         # meant no traffic reached the local container.
         - subnet: 192.168.255.0/24
-          ip_range: 192.168.255.0/24
+          ip_range: 192.168.255.0/24

go.mod

@@ -54,6 +54,7 @@ require (
 	github.com/spf13/viper v1.19.0
 	github.com/stretchr/testify v1.10.0
 	github.com/vrischmann/envconfig v1.4.1
+	golang.org/x/crypto v0.39.0
 	golang.org/x/oauth2 v0.27.0
 	golang.org/x/tools v0.33.0
 	gopkg.in/yaml.v2 v2.4.0
@@ -152,7 +153,6 @@ require (
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/crypto v0.39.0 // indirect
 	golang.org/x/exp v0.0.0-20240909161429-701f63a606c0 // indirect
 	golang.org/x/mod v0.25.0 // indirect
 	golang.org/x/net v0.41.0 // indirect

internal/provisioner/pgbouncer/pgbouncer.go

@@ -24,6 +24,7 @@ listen_addr = *
 listen_port = 5432
 auth_file = /etc/userlist/userlist.txt
 auth_query = SELECT usename, passwd FROM pgbouncer.pgbouncer_users WHERE usename=$1
+auth_type = scram-sha-256
 admin_users = admin
 ignore_startup_parameters = extra_float_digits
 tcp_keepalive = 1

internal/tools/aws/database_multitenant_pgbouncer.go

@@ -6,7 +6,6 @@ package aws
 
 import (
 	"context"
-	"crypto/md5"
 	"database/sql"
 	"fmt"
 	"strings"
@@ -350,7 +349,13 @@ func (d *RDSMultitenantPGBouncerDatabase) provisionPGBouncerDatabase(vpcID strin
 	ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(DefaultMySQLContextTimeSeconds*time.Second))
 	defer cancel()
 
-	err = ensureDatabaseUserIsCreated(ctx, d.db, authUserSecret.MasterUsername, authUserSecret.MasterPassword)
+	// Generate SCRAM-SHA-256 hash for the auth user password
+	authScramHash, err := generateSCRAMSHA256Hash(authUserSecret.MasterPassword)
+	if err != nil {
+		return errors.Wrap(err, "failed to generate SCRAM-SHA-256 hash for auth user")
+	}
+
+	err = ensureDatabaseUserIsCreatedWithHash(ctx, d.db, authUserSecret.MasterUsername, authScramHash)
 	if err != nil {
 		return errors.Wrap(err, "failed to ensure pgbouncer user was created")
 	}
@@ -456,12 +461,18 @@ func (d *RDSMultitenantPGBouncerDatabase) ensureLogicalDatabaseSetup(databaseNam
 		return errors.Wrap(err, "failed to get a secret for installation")
 	}
 
-	err = ensureDatabaseUserIsCreated(ctx, d.db, installationSecret.MasterUsername, installationSecret.MasterPassword)
+	// Generate SCRAM-SHA-256 hash once to ensure consistency between PostgreSQL user and PGBouncer entry
+	scramHash, err := generateSCRAMSHA256Hash(installationSecret.MasterPassword)
+	if err != nil {
+		return errors.Wrap(err, "failed to generate SCRAM-SHA-256 hash")
+	}
+
+	err = ensureDatabaseUserIsCreatedWithHash(ctx, d.db, installationSecret.MasterUsername, scramHash)
 	if err != nil {
 		return errors.Wrap(err, "failed to create Mattermost database user")
 	}
 
-	err = d.ensureInstallationUserAddedToUsersTable(ctx, installationSecret.MasterUsername, installationSecret.MasterPassword)
+	err = d.ensureInstallationUserAddedToUsersTableWithHash(ctx, installationSecret.MasterUsername, scramHash)
 	if err != nil {
 		return errors.Wrap(err, "failed to create Mattermost user entry for PGBouncer")
 	}
@@ -479,7 +490,7 @@ func (d *RDSMultitenantPGBouncerDatabase) ensureLogicalDatabaseSetup(databaseNam
 	return nil
 }
 
-func (d *RDSMultitenantPGBouncerDatabase) ensureInstallationUserAddedToUsersTable(ctx context.Context, username, password string) error {
+func (d *RDSMultitenantPGBouncerDatabase) ensureInstallationUserAddedToUsersTableWithHash(ctx context.Context, username, scramHash string) error {
 	query := fmt.Sprintf("SELECT usename FROM pgbouncer.pgbouncer_users WHERE usename = '%s';", username)
 	rows, err := d.db.QueryContext(ctx, query)
 	if err != nil {
@@ -489,7 +500,7 @@ func (d *RDSMultitenantPGBouncerDatabase) ensureInstallationUserAddedToUsersTabl
 		return nil
 	}
 
-	query = fmt.Sprintf(`INSERT INTO pgbouncer.pgbouncer_users (usename, passwd) VALUES ('%s', 'md5%x')`, username, md5.Sum([]byte(password+username)))
+	query = fmt.Sprintf(`INSERT INTO pgbouncer.pgbouncer_users (usename, passwd) VALUES ('%s', '%s')`, username, scramHash)
 	_, err = d.db.QueryContext(ctx, query)
 	if err != nil {
 		return errors.Wrap(err, "failed to run create pgbouncer installation user SQL command")