Subject: Postgres and Kerberos, take III

From: "Michael Graff" <[email-masked]>
Date: Wed, 23 Nov 1994 22:30:20 CST

I'm still trying to get a system installed using Kerberos 4 authentication.

Here are my goals.  I'm hoping they are all possible.  :)

1)  Have a standard installation, which will allow multiple installs on
    different machines around campus from the same compiled binaries.  This
    means the initial postgres superuser will need to change depending on
    who is installing it.  I think I can do that by munging the line in
    global1.bki, right?

	Change
		insert OID = 0 ( postgres PGUID t t t t )
	to
		insert OID = 0 ( USER USERUID t t t t )

	where USER and USERUID are from the person currently running
	the initdb script (or a wrapper around initdb, or something)

2)  Have no need to make a postgres kerberos instance.  Doing so with goal #1
    would make kerberos authentication pointless because the postgres password
    would need to be widely known, and if anyone can become postgres, anyone
    can be a superuser, more or less.

3)  Not have anything go wrong.  *wishes*  ;)

Is my strategy on #1 at least close to correct?

--Michael

--
Michael Graff    Iowa State University Computation Center      Project Vincent
215 Durham                voice: (515) 294-4994           [email-masked]
Ames, IA  50011           fax:   (515) 294-1717           [email-masked]

==============================================================================
   To add/remove yourself to/from the POSTGRES mailing list: send mail with 
   the subject line ADD or DEL to "[email-masked]".
   If this fails, send mail to "[email-masked]" and
   a human will deal with it.  DO NOT post to the "postgres" mailing list.
==============================================================================
              URL: http://s2k-ftp.CS.Berkeley.EDU:8000/postgres/

---

From: [email-masked] (Paul M. Aoki)
Date: Tue, 29 Nov 94 02:14:50 -0800

> 		insert OID = 0 ( USER USERUID t t t t )

there are instances of PGUID in local1_template1.bki as well (for
indicating the ownership of the base types, functions, etc.).

>     can be a superuser, more or less.

if there is no "postgres" user registered in pg_user, you shouldn't
have any need for a kerberos entry for "postgres".
--
  Paul M. Aoki          |  University of California at Berkeley
  [email-masked]  |  Dept. of EECS, Computer Science Division (#1776) 
                        |  Berkeley, CA 94720-1776