From: Stephen Frost <sfrost@snowman.net>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Jeff Janes <jeff.janes@gmail.com>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: Thomas Munro <thomas.munro@gmail.com>
Cc: k.yudhveer@gmail.com, pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: BUG #16079: Question Regarding the BUG #16064
Date: Mon, 21 Dec 2020 13:35:11 -0500
Message-ID: <20201221183511.GI27507@tamriel.snowman.net> (raw)
In-Reply-To: <543836.1608575492@sss.pgh.pa.us>
References: <16079-29e9c038e1463751@postgresql.org>
<20191028154754.GS6962@tamriel.snowman.net>
<CA+hUKGJw4Ax25=fcCA+DQD=82v2pKu9VGmkYZO8HeH7+-P2Cxw@mail.gmail.com>
<CABUevEwMcFmXqPJgOQfnUV8XgKtWqHPiccNHY+mPJ0AfeFz-7Q@mail.gmail.com>
<20201221005825.GQ16415@tamriel.snowman.net>
<CAMkU=1w4c6NXiKHx-awVw0EeTqqn-Coy_hJGwYkq9WvbEQ1PAw@mail.gmail.com>
<543836.1608575492@sss.pgh.pa.us>
Greetings,
* Tom Lane (tgl@sss.pgh.pa.us) wrote:
> Jeff Janes <jeff.janes@gmail.com> writes:
> > On Sun, Dec 20, 2020 at 7:58 PM Stephen Frost <sfrost@snowman.net> wrote:
> >> * Magnus Hagander (magnus@hagander.net) wrote:
> >>> Maybe we should do the same for LDAP (and RADIUS)? This seems like a
> >>> better place to put it than to log it at every time it's received?
>
> >> A dollar short and a year late, but ... +1.
>
> > I would suggest going further. I would make the change on the client side,
> > and have libpq refuse to send unhashed passwords without having an
> > environment variable set which allows it.
>
> As noted, that would break LDAP and RADIUS auth methods; likely also PAM.
Which would be an altogether good thing as all of those end up exposing
sensitive information should the server be compromised and a user uses
one of them to log in.
The point would be to make it clear to the user, while having an escape
hatch if necessary, that they're sending their password (or pin in the
RADIUS case) to the server.
> > What is the value of logging on the server side?
>
> I do agree with this point, but mostly on the grounds of "nobody reads
> the server log".
I agree that doing this server side really isn't all that helpful.
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: sfrost@snowman.net, tgl@sss.pgh.pa.us, jeff.janes@gmail.com, magnus@hagander.net, thomas.munro@gmail.com, pgsql-hackers@postgresql.org
Subject: Re: BUG #16079: Question Regarding the BUG #16064
In-Reply-To: <20201221183511.GI27507@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox