Skip to content

Commit 42ce743

Browse files
yosifkityosifkit
committed
Error when POSTGRES_PASSWORD is unset like mysql
Add POSTGRES_HOST_AUTH_METHOD to bring back old behavior and be similar to MYSQL_ALLOW_EMPTY_PASSWORD, but add warning when "trust" is used since it disables all passwords
1 parent 0d0485c commit 42ce743

13 files changed

+507
-273
lines changed

‎10/alpine/docker-entrypoint.sh

+39-21
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,10 @@ docker_init_database_dir() {
8787
fi
8888
}
8989

90-
# print large warning if POSTGRES_PASSWORD is empty
90+
# print large warning if POSTGRES_PASSWORD is long
91+
# error if both POSTGRES_PASSWORD is unset and POSTGRES_HOST_AUTH_METHOD is not 'trust'
92+
# print large warning if POSTGRES_HOST_AUTH_METHOD is set to 'trust'
93+
# assumes database is not set up, ie: [ -z "$DATABASE_ALREADY_EXISTS" ]
9194
docker_verify_minimum_env() {
9295
# check password first so we can output the warning before postgres
9396
# messes it up
@@ -103,22 +106,36 @@ docker_verify_minimum_env() {
103106
104107
EOWARN
105108
fi
106-
if [ -z "$POSTGRES_PASSWORD" ]; then
109+
if [ -z "$POSTGRES_PASSWORD" ] && [ 'trust' != "$POSTGRES_HOST_AUTH_METHOD" ]; then
107110
# The - option suppresses leading tabs but *not* spaces. :)
111+
cat >&2 <<-'EOE'
112+
Error: Database is uninitialized and superuser password is not specified.
113+
You must specify POSTGRES_PASSWORD for the superuser. Use
114+
"-e POSTGRES_PASSWORD=password" to set it in "docker run".
115+
116+
You may also use POSTGRES_HOST_AUTH_METHOD=trust to allow all connections
117+
without a password. This is *not* recommended. See PostgreSQL
118+
documentation about "trust":
119+
https://www.postgresql.org/docs/current/auth-trust.html
120+
EOE
121+
exit 1
122+
fi
123+
if [ 'trust' = "$POSTGRES_HOST_AUTH_METHOD" ]; then
108124
cat >&2 <<-'EOWARN'
109-
****************************************************
110-
WARNING: No password has been set for the database.
111-
This will allow anyone with access to the
112-
Postgres port to access your database. In
113-
Docker's default configuration, this is
114-
effectively any other container on the same
115-
system.
116-
117-
Use "-e POSTGRES_PASSWORD=password" to set
118-
it in "docker run".
119-
****************************************************
125+
********************************************************************************
126+
WARNING: POSTGRES_HOST_AUTH_METHOD has been set to "trust". This will allow
127+
anyone with access to the Postgres port to access your database without
128+
a password, even if POSTGRES_PASSWORD is set. See PostgreSQL
129+
documentation about "trust":
130+
https://www.postgresql.org/docs/current/auth-trust.html
131+
In Docker's default configuration, this is effectively any other
132+
container on the same system.
133+
134+
It is not recommended to use POSTGRES_HOST_AUTH_METHOD=trust. Replace
135+
it with "-e POSTGRES_PASSWORD=password" instead to set a password in
136+
"docker run".
137+
********************************************************************************
120138
EOWARN
121-
122139
fi
123140
}
124141

@@ -185,6 +202,8 @@ docker_setup_env() {
185202
file_env 'POSTGRES_USER' 'postgres'
186203
file_env 'POSTGRES_DB' "$POSTGRES_USER"
187204
file_env 'POSTGRES_INITDB_ARGS'
205+
# default authentication method is md5
206+
: "${POSTGRES_HOST_AUTH_METHOD:=md5}"
188207

189208
declare -g DATABASE_ALREADY_EXISTS
190209
# look specifically for PG_VERSION, as it is expected in the DB dir
@@ -193,16 +212,15 @@ docker_setup_env() {
193212
fi
194213
}
195214

196-
# append md5 or trust auth to pg_hba.conf based on existence of POSTGRES_PASSWORD
215+
# append POSTGRES_HOST_AUTH_METHOD to pg_hba.conf for "host" connections
197216
pg_setup_hba_conf() {
198-
local authMethod='md5'
199-
if [ -z "$POSTGRES_PASSWORD" ]; then
200-
authMethod='trust'
201-
fi
202-
203217
{
204218
echo
205-
echo "host all all all $authMethod"
219+
if [ 'trust' = "$POSTGRES_HOST_AUTH_METHOD" ]; then
220+
echo '# warning trust is enabled for all connections'
221+
echo '# see https://www.postgresql.org/docs/12/auth-trust.html'
222+
fi
223+
echo "host all all all $POSTGRES_HOST_AUTH_METHOD"
206224
} >> "$PGDATA/pg_hba.conf"
207225
}
208226

‎10/docker-entrypoint.sh

+39-21
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,10 @@ docker_init_database_dir() {
8787
fi
8888
}
8989

90-
# print large warning if POSTGRES_PASSWORD is empty
90+
# print large warning if POSTGRES_PASSWORD is long
91+
# error if both POSTGRES_PASSWORD is unset and POSTGRES_HOST_AUTH_METHOD is not 'trust'
92+
# print large warning if POSTGRES_HOST_AUTH_METHOD is set to 'trust'
93+
# assumes database is not set up, ie: [ -z "$DATABASE_ALREADY_EXISTS" ]
9194
docker_verify_minimum_env() {
9295
# check password first so we can output the warning before postgres
9396
# messes it up
@@ -103,22 +106,36 @@ docker_verify_minimum_env() {
103106
104107
EOWARN
105108
fi
106-
if [ -z "$POSTGRES_PASSWORD" ]; then
109+
if [ -z "$POSTGRES_PASSWORD" ] && [ 'trust' != "$POSTGRES_HOST_AUTH_METHOD" ]; then
107110
# The - option suppresses leading tabs but *not* spaces. :)
111+
cat >&2 <<-'EOE'
112+
Error: Database is uninitialized and superuser password is not specified.
113+
You must specify POSTGRES_PASSWORD for the superuser. Use
114+
"-e POSTGRES_PASSWORD=password" to set it in "docker run".
115+
116+
You may also use POSTGRES_HOST_AUTH_METHOD=trust to allow all connections
117+
without a password. This is *not* recommended. See PostgreSQL
118+
documentation about "trust":
119+
https://www.postgresql.org/docs/current/auth-trust.html
120+
EOE
121+
exit 1
122+
fi
123+
if [ 'trust' = "$POSTGRES_HOST_AUTH_METHOD" ]; then
108124
cat >&2 <<-'EOWARN'
109-
****************************************************
110-
WARNING: No password has been set for the database.
111-
This will allow anyone with access to the
112-
Postgres port to access your database. In
113-
Docker's default configuration, this is
114-
effectively any other container on the same
115-
system.
116-
117-
Use "-e POSTGRES_PASSWORD=password" to set
118-
it in "docker run".
119-
****************************************************
125+
********************************************************************************
126+
WARNING: POSTGRES_HOST_AUTH_METHOD has been set to "trust". This will allow
127+
anyone with access to the Postgres port to access your database without
128+
a password, even if POSTGRES_PASSWORD is set. See PostgreSQL
129+
documentation about "trust":
130+
https://www.postgresql.org/docs/current/auth-trust.html
131+
In Docker's default configuration, this is effectively any other
132+
container on the same system.
133+
134+
It is not recommended to use POSTGRES_HOST_AUTH_METHOD=trust. Replace
135+
it with "-e POSTGRES_PASSWORD=password" instead to set a password in
136+
"docker run".
137+
********************************************************************************
120138
EOWARN
121-
122139
fi
123140
}
124141

@@ -185,6 +202,8 @@ docker_setup_env() {
185202
file_env 'POSTGRES_USER' 'postgres'
186203
file_env 'POSTGRES_DB' "$POSTGRES_USER"
187204
file_env 'POSTGRES_INITDB_ARGS'
205+
# default authentication method is md5
206+
: "${POSTGRES_HOST_AUTH_METHOD:=md5}"
188207

189208
declare -g DATABASE_ALREADY_EXISTS
190209
# look specifically for PG_VERSION, as it is expected in the DB dir
@@ -193,16 +212,15 @@ docker_setup_env() {
193212
fi
194213
}
195214

196-
# append md5 or trust auth to pg_hba.conf based on existence of POSTGRES_PASSWORD
215+
# append POSTGRES_HOST_AUTH_METHOD to pg_hba.conf for "host" connections
197216
pg_setup_hba_conf() {
198-
local authMethod='md5'
199-
if [ -z "$POSTGRES_PASSWORD" ]; then
200-
authMethod='trust'
201-
fi
202-
203217
{
204218
echo
205-
echo "host all all all $authMethod"
219+
if [ 'trust' = "$POSTGRES_HOST_AUTH_METHOD" ]; then
220+
echo '# warning trust is enabled for all connections'
221+
echo '# see https://www.postgresql.org/docs/12/auth-trust.html'
222+
fi
223+
echo "host all all all $POSTGRES_HOST_AUTH_METHOD"
206224
} >> "$PGDATA/pg_hba.conf"
207225
}
208226

‎11/alpine/docker-entrypoint.sh

+39-21
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,10 @@ docker_init_database_dir() {
8787
fi
8888
}
8989

90-
# print large warning if POSTGRES_PASSWORD is empty
90+
# print large warning if POSTGRES_PASSWORD is long
91+
# error if both POSTGRES_PASSWORD is unset and POSTGRES_HOST_AUTH_METHOD is not 'trust'
92+
# print large warning if POSTGRES_HOST_AUTH_METHOD is set to 'trust'
93+
# assumes database is not set up, ie: [ -z "$DATABASE_ALREADY_EXISTS" ]
9194
docker_verify_minimum_env() {
9295
# check password first so we can output the warning before postgres
9396
# messes it up
@@ -103,22 +106,36 @@ docker_verify_minimum_env() {
103106
104107
EOWARN
105108
fi
106-
if [ -z "$POSTGRES_PASSWORD" ]; then
109+
if [ -z "$POSTGRES_PASSWORD" ] && [ 'trust' != "$POSTGRES_HOST_AUTH_METHOD" ]; then
107110
# The - option suppresses leading tabs but *not* spaces. :)
111+
cat >&2 <<-'EOE'
112+
Error: Database is uninitialized and superuser password is not specified.
113+
You must specify POSTGRES_PASSWORD for the superuser. Use
114+
"-e POSTGRES_PASSWORD=password" to set it in "docker run".
115+
116+
You may also use POSTGRES_HOST_AUTH_METHOD=trust to allow all connections
117+
without a password. This is *not* recommended. See PostgreSQL
118+
documentation about "trust":
119+
https://www.postgresql.org/docs/current/auth-trust.html
120+
EOE
121+
exit 1
122+
fi
123+
if [ 'trust' = "$POSTGRES_HOST_AUTH_METHOD" ]; then
108124
cat >&2 <<-'EOWARN'
109-
****************************************************
110-
WARNING: No password has been set for the database.
111-
This will allow anyone with access to the
112-
Postgres port to access your database. In
113-
Docker's default configuration, this is
114-
effectively any other container on the same
115-
system.
116-
117-
Use "-e POSTGRES_PASSWORD=password" to set
118-
it in "docker run".
119-
****************************************************
125+
********************************************************************************
126+
WARNING: POSTGRES_HOST_AUTH_METHOD has been set to "trust". This will allow
127+
anyone with access to the Postgres port to access your database without
128+
a password, even if POSTGRES_PASSWORD is set. See PostgreSQL
129+
documentation about "trust":
130+
https://www.postgresql.org/docs/current/auth-trust.html
131+
In Docker's default configuration, this is effectively any other
132+
container on the same system.
133+
134+
It is not recommended to use POSTGRES_HOST_AUTH_METHOD=trust. Replace
135+
it with "-e POSTGRES_PASSWORD=password" instead to set a password in
136+
"docker run".
137+
********************************************************************************
120138
EOWARN
121-
122139
fi
123140
}
124141

@@ -185,6 +202,8 @@ docker_setup_env() {
185202
file_env 'POSTGRES_USER' 'postgres'
186203
file_env 'POSTGRES_DB' "$POSTGRES_USER"
187204
file_env 'POSTGRES_INITDB_ARGS'
205+
# default authentication method is md5
206+
: "${POSTGRES_HOST_AUTH_METHOD:=md5}"
188207

189208
declare -g DATABASE_ALREADY_EXISTS
190209
# look specifically for PG_VERSION, as it is expected in the DB dir
@@ -193,16 +212,15 @@ docker_setup_env() {
193212
fi
194213
}
195214

196-
# append md5 or trust auth to pg_hba.conf based on existence of POSTGRES_PASSWORD
215+
# append POSTGRES_HOST_AUTH_METHOD to pg_hba.conf for "host" connections
197216
pg_setup_hba_conf() {
198-
local authMethod='md5'
199-
if [ -z "$POSTGRES_PASSWORD" ]; then
200-
authMethod='trust'
201-
fi
202-
203217
{
204218
echo
205-
echo "host all all all $authMethod"
219+
if [ 'trust' = "$POSTGRES_HOST_AUTH_METHOD" ]; then
220+
echo '# warning trust is enabled for all connections'
221+
echo '# see https://www.postgresql.org/docs/12/auth-trust.html'
222+
fi
223+
echo "host all all all $POSTGRES_HOST_AUTH_METHOD"
206224
} >> "$PGDATA/pg_hba.conf"
207225
}
208226

‎11/docker-entrypoint.sh

+39-21
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,10 @@ docker_init_database_dir() {
8787
fi
8888
}
8989

90-
# print large warning if POSTGRES_PASSWORD is empty
90+
# print large warning if POSTGRES_PASSWORD is long
91+
# error if both POSTGRES_PASSWORD is unset and POSTGRES_HOST_AUTH_METHOD is not 'trust'
92+
# print large warning if POSTGRES_HOST_AUTH_METHOD is set to 'trust'
93+
# assumes database is not set up, ie: [ -z "$DATABASE_ALREADY_EXISTS" ]
9194
docker_verify_minimum_env() {
9295
# check password first so we can output the warning before postgres
9396
# messes it up
@@ -103,22 +106,36 @@ docker_verify_minimum_env() {
103106
104107
EOWARN
105108
fi
106-
if [ -z "$POSTGRES_PASSWORD" ]; then
109+
if [ -z "$POSTGRES_PASSWORD" ] && [ 'trust' != "$POSTGRES_HOST_AUTH_METHOD" ]; then
107110
# The - option suppresses leading tabs but *not* spaces. :)
111+
cat >&2 <<-'EOE'
112+
Error: Database is uninitialized and superuser password is not specified.
113+
You must specify POSTGRES_PASSWORD for the superuser. Use
114+
"-e POSTGRES_PASSWORD=password" to set it in "docker run".
115+
116+
You may also use POSTGRES_HOST_AUTH_METHOD=trust to allow all connections
117+
without a password. This is *not* recommended. See PostgreSQL
118+
documentation about "trust":
119+
https://www.postgresql.org/docs/current/auth-trust.html
120+
EOE
121+
exit 1
122+
fi
123+
if [ 'trust' = "$POSTGRES_HOST_AUTH_METHOD" ]; then
108124
cat >&2 <<-'EOWARN'
109-
****************************************************
110-
WARNING: No password has been set for the database.
111-
This will allow anyone with access to the
112-
Postgres port to access your database. In
113-
Docker's default configuration, this is
114-
effectively any other container on the same
115-
system.
116-
117-
Use "-e POSTGRES_PASSWORD=password" to set
118-
it in "docker run".
119-
****************************************************
125+
********************************************************************************
126+
WARNING: POSTGRES_HOST_AUTH_METHOD has been set to "trust". This will allow
127+
anyone with access to the Postgres port to access your database without
128+
a password, even if POSTGRES_PASSWORD is set. See PostgreSQL
129+
documentation about "trust":
130+
https://www.postgresql.org/docs/current/auth-trust.html
131+
In Docker's default configuration, this is effectively any other
132+
container on the same system.
133+
134+
It is not recommended to use POSTGRES_HOST_AUTH_METHOD=trust. Replace
135+
it with "-e POSTGRES_PASSWORD=password" instead to set a password in
136+
"docker run".
137+
********************************************************************************
120138
EOWARN
121-
122139
fi
123140
}
124141

@@ -185,6 +202,8 @@ docker_setup_env() {
185202
file_env 'POSTGRES_USER' 'postgres'
186203
file_env 'POSTGRES_DB' "$POSTGRES_USER"
187204
file_env 'POSTGRES_INITDB_ARGS'
205+
# default authentication method is md5
206+
: "${POSTGRES_HOST_AUTH_METHOD:=md5}"
188207

189208
declare -g DATABASE_ALREADY_EXISTS
190209
# look specifically for PG_VERSION, as it is expected in the DB dir
@@ -193,16 +212,15 @@ docker_setup_env() {
193212
fi
194213
}
195214

196-
# append md5 or trust auth to pg_hba.conf based on existence of POSTGRES_PASSWORD
215+
# append POSTGRES_HOST_AUTH_METHOD to pg_hba.conf for "host" connections
197216
pg_setup_hba_conf() {
198-
local authMethod='md5'
199-
if [ -z "$POSTGRES_PASSWORD" ]; then
200-
authMethod='trust'
201-
fi
202-
203217
{
204218
echo
205-
echo "host all all all $authMethod"
219+
if [ 'trust' = "$POSTGRES_HOST_AUTH_METHOD" ]; then
220+
echo '# warning trust is enabled for all connections'
221+
echo '# see https://www.postgresql.org/docs/12/auth-trust.html'
222+
fi
223+
echo "host all all all $POSTGRES_HOST_AUTH_METHOD"
206224
} >> "$PGDATA/pg_hba.conf"
207225
}
208226

0 commit comments

Comments
 (0)