pg.ddx.io pgsql-docs@postgresql.org mailing list archive
help / color / mirror / Atom feedunclear wording re: spoofing prevention on network connections
5+ messages / 4 participants
[nested] [flat]
* unclear wording re: spoofing prevention on network connections
@ 2023-12-08 17:42 PG Doc comments form <noreply@postgresql.org>
0 siblings, 1 reply; 5+ messages in thread
From: PG Doc comments form @ 2023-12-08 17:42 UTC (permalink / raw)
To: pgsql-docs@lists.postgresql.org; +Cc: edgecase14@gmail.com
The following documentation comment has been logged on the website:
Page: https://www.postgresql.org/docs/16/preventing-server-spoofing.html
Description:
When I read:
To prevent spoofing on TCP connections, either use SSL certificates and make
sure that clients check the server's certificate, or use GSSAPI encryption
(or both, if they're on separate connections).
It takes some thought to figure out what "separate connections" are being
referred to. Does it mean separate TLS connection and
non-tls-with-gssapi-encryption?
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: unclear wording re: spoofing prevention on network connections
@ 2023-12-09 16:29 Bruce Momjian <bruce@momjian.us>
parent: PG Doc comments form <noreply@postgresql.org>
0 siblings, 1 reply; 5+ messages in thread
From: Bruce Momjian @ 2023-12-09 16:29 UTC (permalink / raw)
To: edgecase14@gmail.com; pgsql-docs@lists.postgresql.org; +Cc: Stephen Frost <sfrost@snowman.net>
On Fri, Dec 8, 2023 at 05:42:27PM +0000, PG Doc comments form wrote:
> The following documentation comment has been logged on the website:
>
> Page: https://www.postgresql.org/docs/16/preventing-server-spoofing.html
> Description:
>
> When I read:
> To prevent spoofing on TCP connections, either use SSL certificates and make
> sure that clients check the server's certificate, or use GSSAPI encryption
> (or both, if they're on separate connections).
>
> It takes some thought to figure out what "separate connections" are being
> referred to. Does it mean separate TLS connection and
> non-tls-with-gssapi-encryption?
I have no idea. It was added in this commit:
commit b0b39f72b9
Author: Stephen Frost <sfrost@snowman.net>
Date: Wed Apr 3 15:02:33 2019 -0400
GSSAPI encryption support
On both the frontend and backend, prepare for GSSAPI encryption
support by moving common code for error handling into a separate file.
Fix a TODO for handling multiple status messages in the process.
Eliminate the OIDs, which have not been needed for some time.
...
I have CC'ed the patch author.
--
Bruce Momjian <bruce@momjian.us> https://momjian.us
EDB https://enterprisedb.com
Only you can decide what is important to you.
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: unclear wording re: spoofing prevention on network connections
@ 2023-12-09 16:52 Stephen Frost <sfrost@snowman.net>
parent: Bruce Momjian <bruce@momjian.us>
0 siblings, 1 reply; 5+ messages in thread
From: Stephen Frost @ 2023-12-09 16:52 UTC (permalink / raw)
To: Bruce Momjian <bruce@momjian.us>; +Cc: edgecase14@gmail.com; pgsql-docs@lists.postgresql.org
Greetings,
On Sat, Dec 9, 2023 at 17:29 Bruce Momjian <bruce@momjian.us> wrote:
> On Fri, Dec 8, 2023 at 05:42:27PM +0000, PG Doc comments form wrote:
> > The following documentation comment has been logged on the website:
> >
> > Page: https://www.postgresql.org/docs/16/preventing-server-spoofing.html
> > Description:
> >
> > When I read:
> > To prevent spoofing on TCP connections, either use SSL certificates and
> make
> > sure that clients check the server's certificate, or use GSSAPI
> encryption
> > (or both, if they're on separate connections).
> >
> > It takes some thought to figure out what "separate connections" are being
> > referred to. Does it mean separate TLS connection and
> > non-tls-with-gssapi-encryption?
Short answer here is “yes, you understand correctly.”
I have no idea. It was added in this commit:
…
Agreed that the wording isn’t great.
The idea is that you can use both TLS and GSSAPI-with-encryption at the
same time within a given cluster for connections but you wouldn’t use them
on the same connection. Certainly would welcome suggestions as to the best
way to phrase that.
Thanks,
Stephen
>
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: unclear wording re: spoofing prevention on network connections
@ 2023-12-09 17:01 David G. Johnston <david.g.johnston@gmail.com>
parent: Stephen Frost <sfrost@snowman.net>
0 siblings, 1 reply; 5+ messages in thread
From: David G. Johnston @ 2023-12-09 17:01 UTC (permalink / raw)
To: Stephen Frost <sfrost@snowman.net>; +Cc: Bruce Momjian <bruce@momjian.us>; edgecase14@gmail.com <edgecase14@gmail.com>; pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>
On Saturday, December 9, 2023, Stephen Frost <sfrost@snowman.net> wrote:
>
>
> The idea is that you can use both TLS and GSSAPI-with-encryption at the
> same time within a given cluster for connections but you wouldn’t use them
> on the same connection. Certainly would welcome suggestions as to the best
> way to phrase that.
>
It isn’t really connection driven though - or even specific to these two
options. The pg_hba.conf file can contain any number of different
authentication methods that are usable simultaneously (from the perspective
of the cluster). But a given login request is only going to match a single
one of those lines; so it isn’t like the client somehow decides during each
login using the same machine and user name which way they are going to
verify who they say they are.
We don’t call out being able to use password and peer simultaneously, the
description and specification of the pg_hba.conf file itself imparts that
information. I’m unclear why these two would warrant a special calling out.
David J.
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: unclear wording re: spoofing prevention on network connections
@ 2023-12-09 17:38 Stephen Frost <sfrost@snowman.net>
parent: David G. Johnston <david.g.johnston@gmail.com>
0 siblings, 0 replies; 5+ messages in thread
From: Stephen Frost @ 2023-12-09 17:38 UTC (permalink / raw)
To: David G. Johnston <david.g.johnston@gmail.com>; +Cc: Bruce Momjian <bruce@momjian.us>; edgecase14@gmail.com <edgecase14@gmail.com>; pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>
Greetings,
On Sat, Dec 9, 2023 at 18:02 David G. Johnston <david.g.johnston@gmail.com>
wrote:
> On Saturday, December 9, 2023, Stephen Frost <sfrost@snowman.net> wrote:
>
>>
>>
>> The idea is that you can use both TLS and GSSAPI-with-encryption at the
>> same time within a given cluster for connections but you wouldn’t use them
>> on the same connection. Certainly would welcome suggestions as to the best
>> way to phrase that.
>>
>
> It isn’t really connection driven though - or even specific to these two
> options. The pg_hba.conf file can contain any number of different
> authentication methods that are usable simultaneously (from the perspective
> of the cluster). But a given login request is only going to match a single
> one of those lines; so it isn’t like the client somehow decides during each
> login using the same machine and user name which way they are going to
> verify who they say they are.
>
Not sure how it isn’t connection driven- as mentioned, the options are
available and can be used at the same time but only on independent
connections.
>
Didn’t mean to suggest it was really up to the client. Also- you can use
TLS with GSSAPI, just not with GSSAPI-with-encryption.
We don’t call out being able to use password and peer simultaneously, the
> description and specification of the pg_hba.conf file itself imparts that
> information. I’m unclear why these two would warrant a special calling out.
>
Cross verification between client and server with encryption…. Perhaps
SCRAM with channel binding and TLS could also be listed. Password doesn’t
provide this security, nor does LDAP, nor PAM. Peer doesn’t provide
encryption (tho fair that it isn’t really necessary, but that doesn’t make
it meet the criteria or intention of this).
Thanks,
Stephen
>
^ permalink raw reply [nested|flat] 5+ messages in thread
end of thread, other threads:[~2023-12-09 17:38 UTC | newest]
Thread overview: 5+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2023-12-08 17:42 unclear wording re: spoofing prevention on network connections PG Doc comments form <noreply@postgresql.org>
2023-12-09 16:29 ` Bruce Momjian <bruce@momjian.us>
2023-12-09 16:52 ` Stephen Frost <sfrost@snowman.net>
2023-12-09 17:01 ` David G. Johnston <david.g.johnston@gmail.com>
2023-12-09 17:38 ` Stephen Frost <sfrost@snowman.net>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox