From: Albert Schabhuetl <albert_schabhuetl@yahoo.de>
To: PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
To: Thomas Munro <thomas.munro@enterprisedb.com>
Subject: Re: BUG #15520: PAM authentication + domain socket -> DNS query for symbolic hostname [local]
Date: Sun, 25 Nov 2018 20:09:42 +0000 (UTC)
Message-ID: <1818527878.10526478.1543176582167@mail.yahoo.com> (raw)
In-Reply-To: <CAEepm=17Ak+5ZeFjj9OAHj=ZMyeLfYDMYJY-Dt0bqe3ZYioEKw@mail.gmail.com>
References: <15520-4c266f986998e1c5@postgresql.org>
<CAEepm=016cNC9+Lj_xQOwL+B1XaoofQB8E_qLgPTzea=KfBeWg@mail.gmail.com>
<CAEepm=17Ak+5ZeFjj9OAHj=ZMyeLfYDMYJY-Dt0bqe3ZYioEKw@mail.gmail.com>
NULL vs hostname for PAM_RHOST:
My understanding is that the purpose of the PAM configuration parameter pam_use_hostname is to avoid the adverse effects of DNS queries if set to 0. Thus if pam_use_hostname is 0, PAM_RHOST shall be NULL for domain socket connections, just like it is the case for TCP connections.
>I wonder if anyone out there has come to rely on the value "[local]"I vote for changing it, and documenting it in the release notes.
regards,Albert
Am Samstag, 24. November 2018, 22:58:01 MEZ hat Thomas Munro <thomas.munro@enterprisedb.com> Folgendes geschrieben:
On Sun, Nov 25, 2018 at 12:57 AM Thomas Munro
<thomas.munro@enterprisedb.com> wrote:
> It seems we shouldn't be passing a bogus hostname in PAM_RHOST.
I wonder if we should simply not set PAM_RHOST for Unix sockets, since
(in the words of the Linux PAM man page) "[i]n some applications,
PAM_RHOST may be NULL", or set it to the hostname of the local
machine, since in a general sense it is "the hostname of the machine
from which the PAM_RUSER entity is requesting service" (Linux PAM) and
"[t]he name of the applicant's host" (OpenPAM). The latter doesn't
seem great because it means that a PAM module loses the ability to
distinguish this case from the IP case, so I think the former is
probably better. I haven't managed to find anything explicit about
the expected value of PAM_RHOST for Unix sockets in either the Linux
PAM or OpenPAM projects.
I wonder if anyone out there has come to rely on the value "[local]"
that PostgreSQL generates for this case (ie in a custom PAM module or
script executed with pam_exec.so), and would get upset if we changed
it. Seems pretty unlikely.
The comments for pg_getnameinfo_all() could probably do with a mention
of the special value written to "node" for Unix sockets.
Some relevant code:
We can see that linux-audit only starts trying to resolve host if you
didn't also pass in an address:
https://github.com/linux-audit/audit-userspace/blob/e42602b7b246ae62e7a12e9cd91f0ac37b1b1968/lib/aud...
We can also see that linux-pam always passes NULL as an address:
https://github.com/linux-pam/linux-pam/blob/955b3e2f100205be2db4358e9c812de2ae453b8e/libpam/pam_audi...
--
Thomas Munro
http://www.enterprisedb.com
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: albert_schabhuetl@yahoo.de, pgsql-bugs@lists.postgresql.org, thomas.munro@enterprisedb.com
Subject: Re: BUG #15520: PAM authentication + domain socket -> DNS query for symbolic hostname [local]
In-Reply-To: <1818527878.10526478.1543176582167@mail.yahoo.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox