Date: Mon, 21 Dec 2020 14:06:08 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Magnus Hagander <magnus@hagander.net>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, Jeff Janes <jeff.janes@gmail.com>,
	Thomas Munro <thomas.munro@gmail.com>, k.yudhveer@gmail.com,
	pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: BUG #16079: Question Regarding the BUG #16064
Message-ID: <20201221190608.GM27507@tamriel.snowman.net>
References: <16079-29e9c038e1463751@postgresql.org>
 <20191028154754.GS6962@tamriel.snowman.net>
 <CA+hUKGJw4Ax25=fcCA+DQD=82v2pKu9VGmkYZO8HeH7+-P2Cxw@mail.gmail.com>
 <CABUevEwMcFmXqPJgOQfnUV8XgKtWqHPiccNHY+mPJ0AfeFz-7Q@mail.gmail.com>
 <20201221005825.GQ16415@tamriel.snowman.net>
 <CAMkU=1w4c6NXiKHx-awVw0EeTqqn-Coy_hJGwYkq9WvbEQ1PAw@mail.gmail.com>
 <543836.1608575492@sss.pgh.pa.us>
 <20201221183511.GI27507@tamriel.snowman.net>
 <544464.1608576242@sss.pgh.pa.us>
 <CABUevEzqsLm3QmPqO8k8i8EKy5BxaHFm6oa8A+1EtgmmbBFazA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="E0h0CbphJD8hN+Gf"
Content-Disposition: inline
In-Reply-To: 
 <CABUevEzqsLm3QmPqO8k8i8EKy5BxaHFm6oa8A+1EtgmmbBFazA@mail.gmail.com>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--E0h0CbphJD8hN+Gf
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Magnus Hagander (magnus@hagander.net) wrote:
> On Mon, Dec 21, 2020 at 7:44 PM Tom Lane <tgl@sss.pgh.pa.us> wrote:
> > BTW, do we have a client-side setting to insist that passwords not be
> > sent in MD5 hashing either?  A person who is paranoid about this would
> > likely want to disable that code path as well.
>=20
> I don't think we do, and we possibly should. You can require channel
> binding which will require scram which solves the problem, but it does
> so only for scram.
>=20
> IIRC we've discussed having a parameter that says "allowed
> authentication methods" on the client as well, but I don't believe it
> has been built. But it wouldn't be bad to be able to for example force
> the client to only attempt gssapi auth, regardless of what the server
> asks for, and just fail if it's not there.

The client is able to require a GSS encrypted connection, and a savy
user will realize that they should 'kinit' (or equivilant) locally and
never provide their password explicitly to the psql (or equivilant)
command, but that's certainly less than ideal.

Having a way to explicitly tell libpq what auth methods are acceptable
was discussed previously and does generally seem like a good idea, as
otherwise there's a lot of risk of what are essentially downgrade
attacks.

Thanks,

Stephen

--E0h0CbphJD8hN+Gf
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJf4PIgAAoJEO1sijiDR2RVRXEQALLA7iw1oprC3P5H1agm539V
m042gp/FR7n8UaeLH0SaKDBmogzQ8PIgseLpu3Sdo/1RT8p2vA1z/3oxULNf2SQO
D8FW1FfUSs071BkJXQpbs+AfdxGnsNr1VhXnOy6vvIvQban1NHFaZDTCEwgIeDPw
A/OMSrBmWY0AgHrcBIatu87xE/f3utCg8qwEhONFuF8JJlX/CckFGPyNEuET+64f
YQ94cOlyITHpwKfUuXlsD/UtWz6TGOICbE/BusAvUhu3rRrWk7IUGGF/MswhS6Rx
Jkb60dymnfwEOS1P95EmpQuWvgkGbkT56nV1FQnLv35vPYBVeho4/1HN036duG+q
nE3LiPu4o8q5YbY9D5jW/FzNV+6RIVzuMTPzTo6OjlHofhEEv7JgrOtsZthtqsCq
3Onhh/M5/JNYa1oZLH0hTE6MUfrQ+o+afIPaSHW8dgMJ6lRW5gxW7HybvIhlPuQI
2/IUkXgx4h94/+PtcN81uZKqIruR22CbrxS1KrFux56m7S6QIxXX36vz31w3e6Mm
L/qXryKAPd3BZmntbFuSkxmP/1fsxIVrlK0FElKptBoxYKJHoM0EQoEp+43ok+uX
pkFhDUHXYwSBcz5ueOtwV1E+tVoWjuqjlKa/Uo0BqchEBHD6DZ62Ddd3pnRznG5L
eWcpkS8IcrtY/gvqqfUK
=Zsuj
-----END PGP SIGNATURE-----

--E0h0CbphJD8hN+Gf--