Use scram-sha-256 for password encryption

[stejskalleos]

For #106

[stejskalleos]

master is currently failing with #250

[evgeni]

Due to the way how the container is built (see https://github.com/sclorg/postgresql-container/blob/36708b73fc149e5905f95391f9d29ef7c8c35bcf/13/root/usr/share/container-scripts/postgresql/common.sh#L225-L239) the DB does still accept md5-based connections -- but authentication will obviously fail if the password is not md5-hashed in the DB (which this PR enables).

I think we should add a test to https://github.com/theforeman/foremanctl/blob/master/tests/postgresql_test.py that checks that SCRAM is used for all users.

[evgeni]

postgres=# select * from pg_shadow;
  usename  | usesysid | usecreatedb | usesuper | userepl | usebypassrls |                                                                passwd                                                                 | valuntil | useconfig 
-----------+----------+-------------+----------+---------+--------------+---------------------------------------------------------------------------------------------------------------------------------------+----------+-----------
 postgres  |       10 | t           | t        | t       | t            | md5e2ceb44a664936df5b29d0e16378643d                                                                                                   |          | 
 candlepin |    16384 | f           | f        | f       | f            | SCRAM-SHA-256$4096:PJ343jfi45fOqeIhGKWThw==$SyT8D2gdNnXnbn8MaqMToJ9zjIHgc5BeawvLvM30VOE=:ZDB7nBu6jmXodUVIkNcN08V33I8tz+rhVniC4gDMLAg= |          | 
 foreman   |    16385 | f           | f        | f       | f            | SCRAM-SHA-256$4096:Lxi7bypxz4hVcFYaTYckWA==$5kedjGTqhlkmt164PB5pgkDk6trNTELxNEvXjRvK/V8=:ulfnTKJ9IEKMkEjyAnQFeMvtn2mlZ5HhOssmWerboII= |          | 
 pulp      |    16386 | f           | f        | f       | f            | SCRAM-SHA-256$4096:QCnZB/nCVzbDej0tHPFDrg==$+R7PhjNNeU/3NF9XhK4pNjN35WJIBEmoKewdTOMHsHk=:QPFUFFnhdkJYNztEDwPQgRHSQaaVHYwJCFW1Y3uuwZw= |          | 
(4 rows)

Ah, yes, the postgres user itself needs adjustment.

Edit:

For writing a test, the following is probably easier to parse:

$ echo 'COPY (select * from pg_shadow) TO STDOUT (FORMAT CSV);' | psql postgres
candlepin,16384,f,f,f,f,SCRAM-SHA-256$4096:PLQk4OyA7njDOZ068ZlmPA==$UuRCEhizzv0puNHO7xsgphPP99PNeW3zmWHQJ/ei7/o=:U3LKjD6MMCKUBrhl9shWvXdjrpXijsl0oUZvXX0eTLA=,,
foreman,16385,f,f,f,f,SCRAM-SHA-256$4096:lD9tdiQGx6402Oxt9YWxmQ==$MTMJl0Cgw2sAxp3W6+K3H73SqhtW5xO4zdsvQkapnF4=:fy+Bh69Z33AA52uNIizoiPaC0DE/4ULZiiNGvzYx6ys=,,
pulp,16386,f,f,f,f,SCRAM-SHA-256$4096:p8/xPB5EI3cPiYw2Kvti7g==$QVsUbHrNK9N2R1PtnBuPZ/ez32CqLgAXNgewO4GHcxA=:5rxOmURiAw51g4QzNFmYcpEnHzGEeaITaZ3dMIhRBzY=,,
postgres,10,t,t,t,t,SCRAM-SHA-256$4096:LBoHxRcdtdeXBowUZA2Wsg==$bND9jzTI4Ylnx0lhnrG4PL8FId7/FNL9bVJq+lmFljM=:QB6PUZ5XpLwJaTvP50dMZ5HWFM8r/HJXNcXjJLrvm/w=,,

Also, a container restart is sufficient to fix the password of the postgres user. (As it gets reset by the container start script, and now scram is default)