The following bug has been logged on the website:

Bug reference: 6412
Logged by: Andy Grimm
Email address: agrimm (AT) gmail (DOT) com
PostgreSQL version: 9.1.2
Operating system: Linux (Fedora)
Description:

When psql prompts for a password, it only reads the first 100 characters of
the password. The limit in fe-connect.c (for when .pgpass is used) is
weirder, a seemingly arbitrary 320 bytes for all fields combined. Other
(postgresql-jdbc, PyGreSQL, etc.) have no problem with a 512-byte password.
It would be nice to have these limits controlled by a constant, and for the
command to give an error or warning when a password is truncated.


--
Sent via pgsql-bugs mailing list (pgsql-bugs (AT) postgresql (DOT) org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-bugs

On 27-01-2012 23:15, agrimm (AT) gmail (DOT) com wrote:
password? If you are not comfortable with this reasonable limit, look at
fe-connect.c -> PasswordFromFile() and change the LINELEN. More to the point,
AFAICS all of the PostgreSQL client prompts are limited to 100 bytes (look at
simple_prompt function); letting 220 bytes for host, port, database, and user.


--
Euler Taveira de Oliveira - Timbira http://www.timbira.com.br/
PostgreSQL: Consultoria, Desenvolvimento, Suporte 24x7 e Treinamento

--
Sent via pgsql-bugs mailing list (pgsql-bugs (AT) postgresql (DOT) org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-bugs

On Sat, Jan 28, 2012 at 11:55 AM, Euler Taveira de Oliveira
<euler (AT) timbira (DOT) com> wrote:
First, thank you for the quick response.

IMHO, there is a subtle difference here. If psql raised an error
message on passwords exceeding 100 characters, I would understand your
perspective, but I think that simply truncating the password and
continuing on is a bug. I also think that hard-coding the number
"100" in several places is simply poor practice which should be
corrected, and that if there's good reason for that to be the password
length limit, it should be uniformly enforced.

Regardless, of whether it's a bug or feature, though, the fixes are
trivial, so I'm not sure what a strong argument _against_ the changes
would be.

The password is not of my choosing. It's an autogenerated sha hash of
an RSA key, and i've simply been the key to use.
While I agree that it's generally impractical to use such a long
password at the command line, more than 99% of the use of this
password is programmatic, and if I complain to the author that the
password is too long, he'll respond "it works for me with JDBC; you
are using broken tools.

I looked at the code before I wrote up the issue, and I have written
and tested a patch. I've posted it here:

https://bugzilla.redhat.com/attachment.cgi?id=558061

As you might expect, it simply defines a constant called PASSWDLEN and
uses that in the calls to simple_prompt, as well as in initdb's
reading of pwfile (which inexplicably uses MAXPGPATH as the maximum
password length today).

Perhaps I should just submit the patch to pgsql-hackers ? I'm new to
the pgsql bug interaction process, so my apologies if filing a bug was
not the appropriate way to present the issue. I get Internal Server
Error messages when I attempt to subscribe to any of the pgsql mailing
lists, so this makes communication with the lists difficult.

--Andy

--
Sent via pgsql-bugs mailing list (pgsql-bugs (AT) postgresql (DOT) org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-bugs

Euler Taveira de Oliveira <euler (AT) timbira (DOT) com> writes:
Yeah, I think the reason we're not too consistent about this is that
nobody ever imagined that limits of 100 bytes or more would pose an
issue in practice. What's the use-case for passwords longer than
that?

regards, tom lane

--
Sent via pgsql-bugs mailing list (pgsql-bugs (AT) postgresql (DOT) org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-bugs

On 28-01-2012 14:32, Andy Grimm wrote:
improved; such a constant is one of those improvements.

such a long password typing or (of course) copy/paste it, will I? Again,
patches are welcome.


redirect this thread to -hackers.


--
Euler Taveira de Oliveira - Timbira http://www.timbira.com.br/
PostgreSQL: Consultoria, Desenvolvimento, Suporte 24x7 e Treinamento

--
Sent via pgsql-bugs mailing list (pgsql-bugs (AT) postgresql (DOT) org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-bugs

Excerpts from Andy Grimm's message of s=C3=A1b ene 28 14:32:24 -0300 2012:

Err, it's not the first time I hear about this, but I haven't been able
to detect a problem anywhere. Exactly how are you trying to subscribe?

--=20
=C3=81lvaro Herrera <alvherre (AT) commandprompt (DOT) com>
The PostgreSQL Company - Command Prompt, Inc.
PostgreSQL Replication, Consulting, Custom Development, 24x7 support

--=20
Sent via pgsql-bugs mailing list (pgsql-bugs (AT) postgresql (DOT) org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-bugs

On Sat, Jan 28, 2012 at 5:48 PM, Alvaro Herrera
<alvherre (AT) commandprompt (DOT) com> wrote:
Thanks for the concern, Alvaro. As it turns out, despite the 500 ISE
message returned in my browser, I did receive a confirmation email and
was able to subscribe to this list, so it's not entirely broken. As
for how I tried to subscribe, I simply went to
http://www.postgresql.org/mailpref/pgsql-bugs (which is the link
provided at http://archives.postgresql.org/pgsql-bugs/ ).

--Andy


--
Sent via pgsql-bugs mailing list (pgsql-bugs (AT) postgresql (DOT) org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-bugs

On 28-01-2012 18:55, Andy Grimm wrote:
should not because we aim for backward compatibility.

simple_prompt() and (ii) raise an error when we reach that limit and (iii) fix
the PasswordFromFile(). Looking at your patch, it seems to fix only (i).



--
Euler Taveira de Oliveira - Timbira http://www.timbira.com.br/
PostgreSQL: Consultoria, Desenvolvimento, Suporte 24x7 e Treinamento

--
Sent via pgsql-bugs mailing list (pgsql-bugs (AT) postgresql (DOT) org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-bugs