pg.ddx.io  pgsql-docs@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
To: Andres Freund <andres@anarazel.de>
To: Andrew Dunstan <andrew.dunstan@2ndquadrant.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: pgsql-hackers@lists.postgresql.org
Subject: Re: initdb recommendations
Date: Wed, 24 Jul 2019 22:08:34 +0200
Message-ID: <29164e47-8dfb-4737-2a61-e67a18f847f3@2ndquadrant.com> (raw)
In-Reply-To: <20190722174042.zb6dgvbymwxidltv@alap3.anarazel.de>
References: <20190406180839.GA1921989@rfd.leadboat.com>
	<96389374-9454-d26d-6f79-7c7b15ec14bd@2ndquadrant.com>
	<fcd8848c-618c-23d1-2b39-77b13cb2d0a1@2ndquadrant.com>
	<CAOBaU_bTm5M-787dAw=E3OQ13ag_BqOboVWz9xkjQk1=__MwDQ@mail.gmail.com>
	<91f8272f-117f-2a04-862b-871a7b86eeed@2ndquadrant.com>
	<CAOBaU_Y9quphKH98xCgiAXgTYk5xcfTWcyKO-y3o_UJOk0s2uQ@mail.gmail.com>
	<7b6c4220-e5ef-2a13-18ad-af596c52b71a@2ndquadrant.com>
	<23654.1563804669@sss.pgh.pa.us>
	<7886.1563812705@sss.pgh.pa.us>
	<c0ccc036-8e58-f057-304f-9feb8f6ec80c@2ndQuadrant.com>
	<20190722174042.zb6dgvbymwxidltv@alap3.anarazel.de>

On 2019-07-22 19:40, Andres Freund wrote:
> On 2019-07-22 13:02:13 -0400, Andrew Dunstan wrote:
>> There are a few things we could do. We could force trust auth, or we
>> could add an ident map that allowed $USER to login as buildfarm. Finding
>> all the places we would need to fix that could be a fun project ...
> 
> Perhaps we could actually do so automatically when the initdb invoking
> user isn't the same as the OS user? Imo that'd be generally quite
> useful, and not just for the regression tets.

It seems to me that there is something missing in our client
authentication system here.

If I'm logged in as the OS user that owns the data directory, I should
be able to log in to the database system via local socket as any user.
Because why stop me?  I can just change pg_hba.conf to let me in.

That would also address this problem that when you use the initdb -U
option, the proposed default "peer" setting doesn't help you much.
Making a pg_ident.conf map automatically helps for that particular user
combination, but then not for other users.  (There is no "sameuser plus
these additional mappings".)

I think we could just define that if geteuid == getpeereid, then
authentication succeeds.  Possibly make that a setting if someone wants
to turn it off.

-- 
Peter Eisentraut              http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services





view thread (61+ messages)  latest in thread

Message-ID: <29164e47-8dfb-4737-2a61-e67a18f847f3@2ndquadrant.com>
Permalink:  ../29164e47-8dfb-4737-2a61-e67a18f847f3@2ndquadrant.com/
Also on:    postgresql.org/message-id/29164e47-8dfb-4737-2a61-e67a18f847f3@2ndquadrant.com

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-docs@postgresql.org
  Cc: peter.eisentraut@2ndquadrant.com, andres@anarazel.de, andrew.dunstan@2ndquadrant.com, tgl@sss.pgh.pa.us, pgsql-hackers@lists.postgresql.org
  Subject: Re: initdb recommendations
  In-Reply-To: <29164e47-8dfb-4737-2a61-e67a18f847f3@2ndquadrant.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox