Skip to content

Commit 987b08e

Browse files
author
nikolay
committed
Merge branch 'master' of github.com:NikolayS/PostgresDBA
2 parents 069af0b + 08b71cf commit 987b08e

File tree

4 files changed

+91
-16
lines changed

4 files changed

+91
-16
lines changed

‎matviews/refresh_all.sql

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
-- Use this to do the very 1st REFRESH for your matviews
22
-- In case when there are complex relations between matviews,
3-
-- it might perform multiple iterations and eventyally refreshes
3+
-- it might perform multiple iterations and eventually refreshes
44
-- all matviews (either all w/o data or absolutely all -- it's up to you).
55

66
-- set thos to TRUE here if you need ALL matviews to be refrehsed, not only those that already have been refreshed
@@ -56,15 +56,14 @@ begin
5656
end;
5757
end loop;
5858

59-
exit when 0 = (select count(*) from pg_matviews where not ispopulated);
6059
iter := iter + 1;
60+
exit when iter > 5 or 0 = (select count(*) from pg_matviews where not ispopulated);
6161
end loop;
6262

63-
raise notice 'Finished! % matviews refreshed in % iterations. It took %', done_cnt, iter, (clock_timestamp() - now())::text;
63+
raise notice 'Finished! % matviews refreshed in % iteration(s). It took %', done_cnt, (iter - 1), (clock_timestamp() - now())::text;
6464
end;
6565
$$ language plpgsql;
6666

6767
reset postgres_dba.refresh_matviews_with_data;
6868
reset client_min_messages;
6969
reset statement_timeout;
70-

‎misc/generate_password.sql

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,16 @@
11
with init(len, arr) as (
2-
select 16, string_to_array('23456789abcdefghjkmnpqrstuvwxyzABCDEFGHJKMNPQRSTUVWXYZ&#%@', null)
2+
-- edit password length and possible characters here
3+
select 16, string_to_array('123456789abcdefghjkmnpqrstuvwxyzABCDEFGHJKMNPQRSTUVWXYZ', null)
34
), arrlen(l) as (
45
select count(*)
56
from (select unnest(arr) from init) _
67
), indexes(i) as (
78
select 1 + int4(random() * (l - 1))
89
from arrlen, (select generate_series(1, len) from init) _
10+
), res as (
11+
select array_to_string(array_agg(arr[i]), '') as password
12+
from init, indexes
913
)
10-
select array_to_string(array_agg(arr[i]), '') as password
11-
from init, indexes
14+
select password--, 'md5' || md5(password || {{username}}) as password_md5
15+
from res
1216
;
13-

‎roles/alter_user_with_random_password.psql

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
-- When you do "ALTER ROLE ... PASSWORD '...';" manually in psql,
2+
-- password goes to log files, psql/bash history files, AWS logfiles, etc.
3+
-- This is insecure.
4+
-- This interactive script solves this problem.
5+
6+
-- Usage (run in psql):
7+
-- 1) Set messages level to DEBUG (and keep logging level higher, to avoid having password in logs):
8+
-- set client_min_messages to DEBUG;
9+
-- 2) Run interactive script in psql:
10+
-- \i /path/to/PostgresDBA/roles/alter_user_with_random_password.psql
11+
12+
\prompt "Username?" postgres_dba_username
13+
\prompt "Superuser? (1 if yes, 0 if no)" postgres_dba_is_superuser
14+
\prompt "Login? (1 if yes, 0 if no)" postgres_dba_login
15+
16+
\set q_postgres_dba_username '\'' :postgres_dba_username '\''
17+
\set q_postgres_dba_is_superuser '\'' :postgres_dba_is_superuser '\''
18+
\set q_postgres_dba_login '\'' :postgres_dba_login '\''
19+
20+
begin;
21+
22+
\o /dev/null
23+
select set_config('postgres_dba.username', :q_postgres_dba_username, true);
24+
select set_config('postgres_dba.is_superuser', :q_postgres_dba_is_superuser, true);
25+
select set_config('postgres_dba.login', :q_postgres_dba_login, true);
26+
\o
27+
28+
do $$
29+
declare
30+
pwd text;
31+
j int4;
32+
allowed text;
33+
allowed_len int4;
34+
sql text;
35+
begin
36+
if current_setting('postgres_dba.username')::text = '' then
37+
raise exception 'Username is not specified.';
38+
end if;
39+
allowed := '23456789abcdefghjkmnpqrstuvwxyzABCDEFGHJKMNPQRSTUVWXYZ';
40+
allowed_len := length(allowed);
41+
pwd := '';
42+
while length(pwd) < 16 loop
43+
j := int4(random() * allowed_len);
44+
pwd := pwd || substr(allowed, j+1, 1);
45+
end loop;
46+
sql := 'alter role ' || current_setting('postgres_dba.username')::text || ' password ''' || pwd || ''';';
47+
raise debug 'SQL: %', sql;
48+
execute sql;
49+
sql := 'alter role ' || current_setting('postgres_dba.username')::text
50+
|| (case when lower(current_setting('postgres_dba.is_superuser')::text) not in ('0', '', 'no', 'false', 'n', 'f') then ' superuser' else '' end)
51+
|| ';';
52+
raise debug 'SQL: %', sql;
53+
execute sql;
54+
sql := 'alter role ' || current_setting('postgres_dba.username')::text
55+
|| (case when lower(current_setting('postgres_dba.login')::text) not in ('0', '', 'no', 'false', 'n', 'f') then ' login' else '' end)
56+
|| ';';
57+
raise debug 'SQL: %', sql;
58+
execute sql;
59+
raise debug 'User % altered, password: %', current_setting('postgres_dba.username')::text, pwd;
60+
end;
61+
$$ language plpgsql;
62+
63+
commit;
64+
65+
\unset postgres_dba_username
66+
\unset postgres_dba_is_superuser
67+
\unset postgres_dba_login
68+
\unset q_postgres_dba_username
69+
\unset q_postgres_dba_is_superuser
70+
\unset q_postgres_dba_login
71+

‎roles/create_user_with_random_password.psql

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,11 @@
33
-- This is insecure.
44
-- This interactive script solves this problem.
55

6-
-- SOLVED: avoid passwords in psql/bash history files
7-
-- TODO: avoid passwords in logfiles (idea: to use function/select/with to print it
8-
-- just to output, w/o any RAISEs that also throws everything to log).
6+
-- Usage (run in psql):
7+
-- 1) Set messages level to DEBUG (and keep logging level higher, to avoid having password in logs):
8+
-- set client_min_messages to DEBUG;
9+
-- 2) Run interactive script in psql:
10+
-- \i /path/to/PostgresDBA/roles/create_user_with_random_password.psql
911

1012
\prompt "Username?" postgres_dba_username
1113
\prompt "Superuser? (1 if yes, 0 if no)" postgres_dba_is_superuser
@@ -34,7 +36,7 @@ begin
3436
if current_setting('postgres_dba.username')::text = '' then
3537
raise exception 'Username is not specified.';
3638
end if;
37-
allowed := '23456789abcdefghjkmnpqrstuvwxyzABCDEFGHJKMNPQRSTUVWXYZ&#%@';
39+
allowed := '23456789abcdefghjkmnpqrstuvwxyzABCDEFGHJKMNPQRSTUVWXYZ';
3840
allowed_len := length(allowed);
3941
pwd := '';
4042
while length(pwd) < 16 loop
@@ -45,18 +47,18 @@ begin
4547
|| (case when lower(current_setting('postgres_dba.is_superuser')::text) not in ('0', '', 'no', 'false', 'n', 'f') then ' superuser' else '' end)
4648
|| (case when lower(current_setting('postgres_dba.login')::text) not in ('0', '', 'no', 'false', 'n', 'f') then ' login' else '' end)
4749
|| ' password ''' || pwd || ''';';
48-
raise notice 'SQL: %', sql;
50+
raise debug 'SQL: %', sql;
4951
execute sql;
50-
raise notice 'User % created, password: %', current_setting('postgres_dba.username')::text, pwd;
52+
raise info 'User % created, password: %', current_setting('postgres_dba.username')::text, pwd;
5153
end;
5254
$$ language plpgsql;
5355

5456
commit;
5557

5658
\unset postgres_dba_username
57-
\unset postgres_dba_username
59+
\unset postgres_dba_is_superuser
5860
\unset postgres_dba_login
5961
\unset q_postgres_dba_username
60-
\unset q_postgres_dba_username
62+
\unset q_postgres_dba_is_superuser
6163
\unset q_postgres_dba_login
6264

0 commit comments

Comments
 (0)