PostgreSQL: How to Set NULL Password for User with ALTER ROLE SQL Command


1 views

In PostgreSQL, user authentication credentials are managed through roles. When you need to modify password settings, the ALTER ROLE SQL command is your primary tool. This becomes particularly useful when you want to disable password authentication for a specific user.

To change a user's password to NULL (effectively removing password authentication), use the following syntax:

ALTER ROLE username WITH PASSWORD NULL;

For your specific case with user 'alex', the command would be:

-- Set NULL password for user 'alex'
ALTER ROLE alex WITH PASSWORD NULL;

When you set a NULL password:

  • The user won't be able to authenticate via password (only other allowed methods)
  • This doesn't disable the account - other auth methods might still work
  • NULL differs from an empty string password

After executing the command, you can verify the change by checking the pg_shadow table:

SELECT usename, passwd FROM pg_shadow WHERE usename = 'alex';

This should return NULL in the passwd column for the specified user.

If you prefer using the psql command-line client, you could also use:

\password alex

Then press Enter twice when prompted for the new password (leaving it blank), though this method might behave differently across PostgreSQL versions.

Remember that setting a NULL password should be combined with proper pg_hba.conf configuration to:

  • Restrict access to trusted networks
  • Implement other authentication methods if needed
  • Monitor authentication attempts

In PostgreSQL, user authentication credentials are managed through the ROLE system (where users and roles are essentially the same concept). The most straightforward way to modify a user's password is through the ALTER ROLE SQL command.

To change the password for user 'alex' to NULL (effectively removing password authentication), you would execute:

ALTER ROLE alex WITH PASSWORD NULL;

Setting a NULL password means:

  • The user can only authenticate via other methods (like peer auth or ident)
  • This is generally NOT recommended for production systems
  • Works only when PostgreSQL's password encryption method is set to trust for that user

If you're working directly in psql, you can also use:

\password alex

Then press Enter twice when prompted for the new password to set it to NULL.

To confirm the password was set to NULL:

SELECT usename, passwd FROM pg_shadow WHERE usename = 'alex';

The passwd field should show NULL for the modified user.

For NULL passwords to work, your pg_hba.conf must allow password-less authentication for the user. Example entry:

local   all   alex   trust

Here's a complete example session:

-- Connect as superuser
psql -U postgres

-- Change the password
ALTER ROLE alex WITH PASSWORD NULL;

-- Verify
SELECT usename, passwd IS NULL AS has_null_pw 
FROM pg_shadow 
WHERE usename = 'alex';

-- Exit
\q

-- Test new authentication
psql -U alex