Date: Mon, 21 Dec 2020 13:35:11 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Jeff Janes <jeff.janes@gmail.com>,
	Magnus Hagander <magnus@hagander.net>,
	Thomas Munro <thomas.munro@gmail.com>, k.yudhveer@gmail.com,
	pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: BUG #16079: Question Regarding the BUG #16064
Message-ID: <20201221183511.GI27507@tamriel.snowman.net>
References: <16079-29e9c038e1463751@postgresql.org>
 <20191028154754.GS6962@tamriel.snowman.net>
 <CA+hUKGJw4Ax25=fcCA+DQD=82v2pKu9VGmkYZO8HeH7+-P2Cxw@mail.gmail.com>
 <CABUevEwMcFmXqPJgOQfnUV8XgKtWqHPiccNHY+mPJ0AfeFz-7Q@mail.gmail.com>
 <20201221005825.GQ16415@tamriel.snowman.net>
 <CAMkU=1w4c6NXiKHx-awVw0EeTqqn-Coy_hJGwYkq9WvbEQ1PAw@mail.gmail.com>
 <543836.1608575492@sss.pgh.pa.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="mXDO3udm/xYWQeMQ"
Content-Disposition: inline
In-Reply-To: <543836.1608575492@sss.pgh.pa.us>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--mXDO3udm/xYWQeMQ
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Tom Lane (tgl@sss.pgh.pa.us) wrote:
> Jeff Janes <jeff.janes@gmail.com> writes:
> > On Sun, Dec 20, 2020 at 7:58 PM Stephen Frost <sfrost@snowman.net> wrot=
e:
> >> * Magnus Hagander (magnus@hagander.net) wrote:
> >>> Maybe we should do the same for LDAP (and RADIUS)? This seems like a
> >>> better place to put it than to log it at every time it's received?
>=20
> >> A dollar short and a year late, but ... +1.
>=20
> > I would suggest going further.  I would make the change on the client s=
ide,
> > and have libpq refuse to send unhashed passwords without having an
> > environment variable set which allows it.
>=20
> As noted, that would break LDAP and RADIUS auth methods; likely also PAM.

Which would be an altogether good thing as all of those end up exposing
sensitive information should the server be compromised and a user uses
one of them to log in.

The point would be to make it clear to the user, while having an escape
hatch if necessary, that they're sending their password (or pin in the
RADIUS case) to the server.

> > What is the value of logging on the server side?
>=20
> I do agree with this point, but mostly on the grounds of "nobody reads
> the server log".

I agree that doing this server side really isn't all that helpful.

Thanks,

Stephen

--mXDO3udm/xYWQeMQ
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJf4OrfAAoJEO1sijiDR2RV96oQALq6LYHYnQ4t87CYI2vsD+Kn
V1NQH/PdQ1J5+1EfJhgR3CyPbycQSERIQ2/SXwY1WoTklTwR0R3xjtsIJiQWlljx
qy6RTMrtUJToWuQOEocgYAU/VsNaV+1ZDYgCzlr0VgoLMrSOphl9qWGmlC7xsxO6
Ph2Xwuwf6WHbo6n1v6myIIzslZjO+54i+6USzZX9aEFTEwkOAW2vnKSZQdr0MaDb
ZcMxGMzRv0VGWEKNPUaYLLdTXMGIE1k4ZUeqRuAW4QQD8Le4GrqLVQJ6cPwKnrut
cQNN1ZAJRUjyQdwqReY9otQWKk7Q2s4zBcxCLyyFyNCTscglkRQlCKVTSINy+afs
mVaT1KlMSyZ2XeUJw6ftIn0wbVFhsqBJlW5uTU/aapsLSQ2Qv//AZPmuSbomyz6D
Sjw7798WTH8nR+XRlLNJn9o8H0Qblzvo5tnINSRDFoeRIt+k5pmPFlkGE4boPa+g
U59ABYZkZhgGyWwHJ0qXTDVW72LlLlm853I+QR8/dwl0pX3xVUj8mU+pIGr7pkDP
64IzqeTPZ4alBFNU7gh0AaXjjyA+cR22iew+6CbmFdQpWysh8fSnaWbbnWBi+/JT
TdBegvQN2MZS3bW8qguOx7TDllxYuuPipQlvzs4vT7+YJEUKYX/OlQCypssZk+3J
stDbdqX+ddyzxG20fFKo
=MNYX
-----END PGP SIGNATURE-----

--mXDO3udm/xYWQeMQ--