Deprecation of SHA hashed passwords (created 2013 or earlier)

Detail name	Value
Changelog Number	9708
Type	Improvement
Status	Resolved
Fix Versions	Exasol 6.1.9, Exasol 6.2.5
Resolution Date	2020-03-17

Background

Prior to version 4.1 (released in early 2013) passwords were hashed with the SHA hashing algorithm. From version 4.1 on passwords were hashed with a secure algorithm, whenever a user was created or a password was changed.

Problem

There are two cases in which users might still have SHA hashed passwords:

1. A password was not changed since 2013
2. The commandline parameter -useCaseSensitivePasswords=0 is in use

Solution

• We added several warnings. The database is triggering warnings whenever a user with an old hash is trying to log in. At startup the database triggers a warning if one of the users uses an old password as well as the parameter -useCaseSensitivePasswords=0 is in use.
• The parameter -useCaseSensitivePasswords=0 has no effect anymore. Passwords are always hashed securely.

In a subsequent patch release, users with SHA hashed passwords will not be able to log in anymore!

If you want to check manually for such users, you can run the following SQL statement as DBA:

select user_name from exa_dba_users where len(password) = 48;

 

Changed behavior

The parameter -useCaseSensitivePasswords=0 has no effect anymore. Passwords are always be hashed securely.