From: Tom Lane <tgl@sss.pgh.pa.us>
To: Laurenz Albe <laurenz.albe@cybertec.at>
Cc: Frank Eckes <frank.eckes@online.de>
Cc: pgsql-admin@lists.postgresql.org
Subject: Re: security issues
Date: Fri, 10 Dec 2021 11:41:27 -0500
Message-ID: <70797.1639154487@sss.pgh.pa.us> (raw)
In-Reply-To: <ba32f586b2ba90c1909f32f6cdabefc3a0fc325d.camel@cybertec.at>
References: <5235c46a-508e-f084-c8bc-738a6e99fd44@online.de>
<ba32f586b2ba90c1909f32f6cdabefc3a0fc325d.camel@cybertec.at>
Laurenz Albe <laurenz.albe@cybertec.at> writes:
> On Fri, 2021-12-10 at 15:33 +0100, Frank Eckes wrote:
>> And even worse, if i define a foreign server (e.g ORACLE) everybody can
>> see the credentials in a user mapping
> Then you use Oracle external authentication, for example with a
> secure key store on the PostgreSQL server. Then you don't need a
> password.
That's one way, but AFAIK the above claim is nonsense. You can
only see the connection options for user mappings that belong
to you (unless you're a superuser).
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: tgl@sss.pgh.pa.us, laurenz.albe@cybertec.at, frank.eckes@online.de, pgsql-admin@lists.postgresql.org
Subject: Re: security issues
In-Reply-To: <70797.1639154487@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox