Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtps
 (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <pgsql-admin-owner+archive@lists.postgresql.org>)
	id 1mvixi-0005gE-Rg
	for pgsql-admin@arkaria.postgresql.org; Fri, 10 Dec 2021 16:41:34 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.92)
	(envelope-from <pgsql-admin-owner+archive@lists.postgresql.org>)
	id 1mvixh-00061G-NZ
	for pgsql-admin@arkaria.postgresql.org; Fri, 10 Dec 2021 16:41:33 +0000
Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29])
	by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <tgl@sss.pgh.pa.us>)
	id 1mvixh-000617-De
	for pgsql-admin@lists.postgresql.org; Fri, 10 Dec 2021 16:41:33 +0000
Received: from sss.pgh.pa.us ([66.207.139.130])
	by magus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <tgl@sss.pgh.pa.us>)
	id 1mvixf-0005u1-3A
	for pgsql-admin@lists.postgresql.org; Fri, 10 Dec 2021 16:41:33 +0000
Received: from pro.sss.pgh.pa.us (localhost [127.0.0.1])
	by sss.pgh.pa.us (8.15.2/8.15.2) with ESMTP id 1BAGfR9w3942964;
	Fri, 10 Dec 2021 11:41:27 -0500
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Laurenz Albe <laurenz.albe@cybertec.at>
cc: Frank Eckes <frank.eckes@online.de>, pgsql-admin@lists.postgresql.org
Subject: Re: security issues
In-reply-to: <ba32f586b2ba90c1909f32f6cdabefc3a0fc325d.camel@cybertec.at>
References: <5235c46a-508e-f084-c8bc-738a6e99fd44@online.de>
 <ba32f586b2ba90c1909f32f6cdabefc3a0fc325d.camel@cybertec.at>
Comments: In-reply-to Laurenz Albe <laurenz.albe@cybertec.at>
	message dated "Fri, 10 Dec 2021 17:20:19 +0100"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <70796.1639154487.1@sss.pgh.pa.us>
Date: Fri, 10 Dec 2021 11:41:27 -0500
Message-ID: <70797.1639154487@sss.pgh.pa.us>
List-Id: <pgsql-admin.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-admin@lists.postgresql.org>
List-Owner: <mailto:pgsql-admin-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-admin>
Archived-At: 
 <https://www.postgresql.org/message-id/70797.1639154487%40sss.pgh.pa.us>
Precedence: bulk

Laurenz Albe <laurenz.albe@cybertec.at> writes:
> On Fri, 2021-12-10 at 15:33 +0100, Frank Eckes wrote:
>> And even worse, if i define a foreign server (e.g ORACLE) everybody can 
>> see the credentials in a user mapping

> Then you use Oracle external authentication, for example with a
> secure key store on the PostgreSQL server.  Then you don't need a
> password.

That's one way, but AFAIK the above claim is nonsense.  You can
only see the connection options for user mappings that belong
to you (unless you're a superuser).

			regards, tom lane