From: geol <geol@cit.sf.ukrtel.net>
To: pgsql-docs@postgresql.org
Subject: pg_hba.conf and Administrator's Guide, 8. Security, User Authentication, Host-Based Access Control
Date: Fri, 05 Oct 2001 22:48:52 +0300
Message-ID: <3BBE0EA4.E97BA47C@cit.sf.ukrtel.net> (raw)
Name : Oleg Katsitadze
Email address: geol@cit.sf.ukrtel.net
Short description of the problem
--------------------------------
Misleading description of `crypt' user authentication method in
pg_hba.conf.
Difference between `crypt' and `password' authentication methods is
(probably) not intuitively discernable in Administrator's Guide.
System configuration
--------------------
Architecture: Intel Pentium MMX
Operating System: Linux 2.4.2-2 (Red Hat Linux release 7.1
Seawolf)
PostgreSQL version: PostgreSQL-7.0.3
Compiler used: gcc 2.96
Detailed description of the problem
-----------------------------------
Default pg_hba.conf in /usr/local/pgsql/data contains the following
description
of `password' and `crypt' authentication methods:
# password: Authentication is done by matching a password supplied
# in clear by the host. If AUTH_ARGUMENT is specified then
# the password is compared with the user's entry in that
# file (in the $PGDATA directory). See pg_passwd(1). If it
# is omitted then the password is compared with the user's
# entry in the pg_shadow table.
#
# crypt: Same as 'password', but authentication is done by
# encrypting the password sent over the network.
This may cause confusion for a new user since `crypt' authentication
type is
NOT the same as `password' as it does not look up password file even if
provided
as AUTH_ARGUMENT. A simple note might be in place for `crypt':
# crypt: Same as 'password', but authentication is done by
# encrypting the password sent over the network. Note:
unlike
# 'password', 'crypt' does not use password file; password
lookup
# is always done in pg_shadow table.
Actually, this behavior can be inferred from Administrator's
Guide, 8. Security, User Authentication, Host-Based Access Control,
which reads:
crypt
The client is asked for a password for the user. This is
sent
encrypted (using crypt(3)) and compared against the
password
held in the pg_shadow table. If the passwords match,
the
connection is allowed.
password
The client is asked for a password for the user. This is
sent
in clear and compared against the password held in
the
pg_shadow table. If the passwords match, the connection
is
allowed. An optional password file may be specified after
the
password keyword which is used to match the supplied
password
rather than the pg_shadow table. See pg_passwd.
It may be more convenient for a reader if description of `crypt' method
would stress out that password file is not being looked up. In any
case, it
will save some hasty readers (like me) several minutes of trying to
configure
`crypt' with a password file, and then coming back to the documentation
to
figure out that `crypt' does not use it.
Thanks,
Oleg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: geol@cit.sf.ukrtel.net
Subject: Re: pg_hba.conf and Administrator's Guide, 8. Security, User Authentication, Host-Based Access Control
In-Reply-To: <3BBE0EA4.E97BA47C@cit.sf.ukrtel.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox