From: Stephen Frost <sfrost@snowman.net>
To: Don Seiler <don@seiler.us>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: pgsql-admin <pgsql-admin@postgresql.org>
Subject: Re: Passwords in clear text in server log
Date: Wed, 11 Oct 2017 12:19:14 -0400
Message-ID: <20171011161914.GN4628@tamriel.snowman.net> (raw)
In-Reply-To: <CAHJZqBCxQth34+KhNji4cQzy9WuNMvpWav863fNDkE0njdq02Q@mail.gmail.com>
References: <CAHJZqBDe1-oiYtdh5pcWLAhr3jsDMFQg4miv3PYADH3YWKqZ2w@mail.gmail.com>
<9072.1507733313@sss.pgh.pa.us>
<CAHJZqBAtBvHuMh5mF66hj-P9sb4hhps1Nv7aR-iZG-90SS8_0Q@mail.gmail.com>
<13879.1507736256@sss.pgh.pa.us>
<CAHJZqBCxQth34+KhNji4cQzy9WuNMvpWav863fNDkE0njdq02Q@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-admin>
Don,
* Don Seiler (don@seiler.us) wrote:
> Long-term I'm hoping to get our PG databases talking to our LDAP, there's a
> few internal issues and priorities that have that on the back burner for
> now.
As I understand it, you're in an Active Directory environment, where
what you really want to be using for authentication is Kerberos / GSSAPI,
not LDAP. With LDAP, the password is still sent to the PG server in
cleartext during the authentication and that's entirely unnecessary in
an Active Directory environment where you have a Kerberos realm already
in place.
Thanks!
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: sfrost@snowman.net, don@seiler.us, tgl@sss.pgh.pa.us
Subject: Re: Passwords in clear text in server log
In-Reply-To: <20171011161914.GN4628@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox