pg.ddx.io pgsql-docs@postgresql.org mailing list archivehelp / color / mirror / Atom feed
Tightening the trust auth advice 2+ messages / 2 participants [nested] [flat]
* Tightening the trust auth advice @ 2023-01-12 09:32 Magnus Hagander <magnus@hagander.net> 0 siblings, 1 reply; 2+ messages in thread From: Magnus Hagander @ 2023-01-12 09:32 UTC (permalink / raw) To: Pg Docs <pgsql-docs@lists.postgresql.org> The page at https://www.postgresql.org/docs/current/auth-trust.html goes through some length to explain why Trust is sometimes a good idea. Is it really though? And in particular, aren't there better choices? As a first step, I think we should put a <warning> box on the page explicitly saying that that trust, unless limited in pg_hba, will allow any user to become superuser which allows them to bypass all other security restrictions. Second, we're kind of going out of our way to recommend setting unix socket permissions etc -- in those cases, wouldn't it in almost every case just be better for the user to use "peer" auth instead of trust, and we should recommend them to use that instead? Is it really any less appropriate and/or convenient? (It was listed as appropriate back in 2001 in 6f0f5bf2fbe, but the world has changed a bit in 20+ years..) And finally, the sentence "It is seldom reasonable to use trust for any TCP/IP connections other than those from localhost (127.0.0.1)." should probably be amended with an ", and only reasonable for localhost if you trust every single user on the host"? Thoughts? I'll be happy to work up a patch if there's agreement on the general idea. -- Magnus Hagander Me: https://www.hagander.net/ <http://www.hagander.net/; Work: https://www.redpill-linpro.com/ <http://www.redpill-linpro.com/; ^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: Tightening the trust auth advice @ 2023-01-12 21:46 Jonathan S. Katz <jkatz@postgresql.org> parent: Magnus Hagander <magnus@hagander.net> 0 siblings, 0 replies; 2+ messages in thread From: Jonathan S. Katz @ 2023-01-12 21:46 UTC (permalink / raw) To: Magnus Hagander <magnus@hagander.net>; Pg Docs <pgsql-docs@lists.postgresql.org> On 1/12/23 4:32 AM, Magnus Hagander wrote: > The page at https://www.postgresql.org/docs/current/auth-trust.html > <https://www.postgresql.org/docs/current/auth-trust.html; goes through > some length to explain why Trust is sometimes a good idea. > > Is it really though? And in particular, aren't there better choices? This first case it lists sounds like a good case for "peer" authentication...and the multi-user case it lists also sounds like a goo use for "peer". The case that I think "trust" is good at, which we don't list, is doing local development / testing of PG. > As a first step, I think we should put a <warning> box on the page > explicitly saying that that trust, unless limited in pg_hba, will allow > any user to become superuser which allows them to bypass all other > security restrictions. +1 > Second, we're kind of going out of our way to recommend setting unix > socket permissions etc -- in those cases, wouldn't it in almost every > case just be better for the user to use "peer" auth instead of trust, > and we should recommend them to use that instead? Is it really any less > appropriate and/or convenient? (It was listed as appropriate back in > 2001 in 6f0f5bf2fbe, but the world has changed a bit in 20+ years..) Yeah, I think forwarding folks to the documentation on "peer" is a good idea here. I don't know if we want to keep any language around for historical context "Prior to "peer" auth, "trust" was used for this but on modern systems you can use "peer" instead for better security." > And finally, the sentence "It is seldom reasonable to use trust for any > TCP/IP connections other than those from localhost (127.0.0.1)." should > probably be amended with an ", and only reasonable for localhost if you > trust every single user on the host"? I'd invert it: "It is not recommended to use "trust" for any TCP/IP (non-local) connection. You should use "trust" with localhost (127.0.0.1) connections only if you trust every single user on that host." > Thoughts? I'll be happy to work up a patch if there's agreement on the > general idea. Reading through this, I'm not shocked there's still a good amount of "trust" prevalent in the wild. I agree with tightening this up. Jonathan Attachments: [application/pgp-signature] OpenPGP_signature (839B, ../../37a6a45c-ee93-041d-664e-12399a021ac6@postgresql.org/2-OpenPGP_signature) download ^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2023-01-12 21:46 UTC | newest] Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2023-01-12 09:32 Tightening the trust auth advice Magnus Hagander <magnus@hagander.net> 2023-01-12 21:46 ` Jonathan S. Katz <jkatz@postgresql.org>
This inbox is served by DDX for PostgreSQL; see mirroring instructions for how to clone and mirror all data and code used for this inbox