From: Noah Misch <noah@leadboat.com>
To: Magnus Hagander <magnus@hagander.net>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Cc: Jonathan S. Katz <jkatz@postgresql.org>
Subject: Re: initdb recommendations
Date: Fri, 24 May 2019 08:23:57 -0700
Message-ID: <20190524152357.GC1624191@rfd.leadboat.com> (raw)
In-Reply-To: <CABUevExdgYkaikDHFtkibqJ=pEamnqnTW_DDuBLoRmtsd9KR8w@mail.gmail.com>
References: <bec17f0a-ddb1-8b95-5e69-368d9d0a3390@postgresql.org>
<f27d3170-76cf-4afb-1e1a-b1059295ec8d@2ndquadrant.com>
<CABUevExMizVYea9zaHBte66u9KipEgfwcsaE9spfqK9iYRST_g@mail.gmail.com>
<20190406180839.GA1921989@rfd.leadboat.com>
<96389374-9454-d26d-6f79-7c7b15ec14bd@2ndquadrant.com>
<CABUevExdgYkaikDHFtkibqJ=pEamnqnTW_DDuBLoRmtsd9KR8w@mail.gmail.com>
On Thu, May 23, 2019 at 06:56:49PM +0200, Magnus Hagander wrote:
> On Thu, May 23, 2019, 18:54 Peter Eisentraut <peter.eisentraut@2ndquadrant.com> wrote:
> > To recap, the idea here was to change the default authentication methods
> > that initdb sets up, in place of "trust".
> >
> > I think the ideal scenario would be to use "peer" for local and some
> > appropriate password method (being discussed elsewhere) for host.
> >
> > Looking through the buildfarm, I gather that the only platforms that
> > don't support peer are Windows, AIX, and HP-UX. I think we can probably
> > figure out some fallback or alternative default for the latter two
> > platforms without anyone noticing. But what should the defaults be on
> > Windows? It doesn't have local sockets, so the lack of peer wouldn't
> > matter. But is it OK to default to a password method, or would that
> > upset people particularly?
>
> I'm sure password would be fine there. It's what "everybody else" does
> (well sqlserver also cord integrated security, but people are used to it).
Our sspi auth is a more-general version of peer auth, and it works over TCP.
It would be a simple matter of programming to support "peer" on Windows,
consisting of sspi auth with an implicit pg_ident map. Nonetheless, I agree
password would be fine.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: noah@leadboat.com, magnus@hagander.net, peter.eisentraut@2ndquadrant.com, pgsql-hackers@postgresql.org, jkatz@postgresql.org
Subject: Re: initdb recommendations
In-Reply-To: <20190524152357.GC1624191@rfd.leadboat.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox