Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.84_2) (envelope-from ) id 1e2Jj5-0005F4-5C for pgsql-admin@arkaria.postgresql.org; Wed, 11 Oct 2017 16:19:19 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.84_2) (envelope-from ) id 1e2Jj4-0007nq-L5 for pgsql-admin@arkaria.postgresql.org; Wed, 11 Oct 2017 16:19:18 +0000 Received: from makus.postgresql.org ([2001:4800:1501:1::229]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1e2Jj4-0007ng-1x for pgsql-admin@postgresql.org; Wed, 11 Oct 2017 16:19:18 +0000 Received: from tamriel.snowman.net ([2001:470:e38f::11]) by makus.postgresql.org with esmtp (Exim 4.84_2) (envelope-from ) id 1e2Jj1-0001op-F1 for pgsql-admin@postgresql.org; Wed, 11 Oct 2017 16:19:16 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id 9B9E15F795; Wed, 11 Oct 2017 12:19:14 -0400 (EDT) Date: Wed, 11 Oct 2017 12:19:14 -0400 From: Stephen Frost To: Don Seiler Cc: Tom Lane , pgsql-admin Subject: Re: Passwords in clear text in server log Message-ID: <20171011161914.GN4628@tamriel.snowman.net> References: <9072.1507733313@sss.pgh.pa.us> <13879.1507736256@sss.pgh.pa.us> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="SyfaytrUuyA4ILHY" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-admin Precedence: bulk Sender: pgsql-admin-owner@postgresql.org --SyfaytrUuyA4ILHY Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Don, * Don Seiler (don@seiler.us) wrote: > Long-term I'm hoping to get our PG databases talking to our LDAP, there's a > few internal issues and priorities that have that on the back burner for > now. As I understand it, you're in an Active Directory environment, where what you really want to be using for authentication is Kerberos / GSSAPI, not LDAP. With LDAP, the password is still sent to the PG server in cleartext during the authentication and that's entirely unnecessary in an Active Directory environment where you have a Kerberos realm already in place. Thanks! Stephen --SyfaytrUuyA4ILHY Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJZ3kSCAAoJEO1sijiDR2RVWAMP/1EWNCqyYSJK1xigARsZwIzD ji6SnLxDuioC1WvWDX5mgwIIX1RL2Qft5bz4PBLwEqsYz18r5GETzO+fKplAhrcF euS+wZ4a54gf5mkrPrqmlMJtP7wZ3MDckLGvM7wmCex4Mh7/hJ7/SA3L0IkS0Jlw uNRh8lWsr7ibe+c38rva+FLzSU3xPfT/kCp4lQ4tTNRVZHvN8/RByfOxEsbylnE8 //eBn9AWwuUyy1k/fV1TBk6VUK4Gw+1y98sDtybzhR2uO+9JBnHJnRKJaVKBy5NZ loz53Ak46ZU1s/lXvvKd8uERy9YATh2wL0FL2F5kEB8GnAo7amA0U9319JItRtt9 ZLYXyyuJS3ypdnGzUgChTJgRuwyT3BHhm1ESJfJM5q5eguwACp8UJZUpxEBe3H2E vV4Ws16ElqMwfLlHrh3RPnZ8uZ4JDpoqhAy4oBD8C1hmr2W24UrHUeSfB7kFe5lr hpaFi6GnNqzJVjfSVg80GOPZ8Go8bz+2cZTWvEBgt7mSgZ8pCrjOxTn0gOi/SrNE ieypthfu/AIj5axgK0X/xahQI2cPKZm4UVOIJUODGwoHfnHEbCmJf6I60h/RDQ7P DP37XiwHk+zIX5y5CLhh/qos4XEUE6DTRo05/31+MXRqcL1Yf6mSDNODGPOlf4km CiQAx2Ep7oZO6WfqF4cP =Sbw+ -----END PGP SIGNATURE----- --SyfaytrUuyA4ILHY--