From: Shane Ambler <pgsql@007Marketing.com>
To: Michael Schmidt <michaelmschmidt@msn.com>
Cc: PostgreSQL General <pgsql-general@postgresql.org>
Subject: Re: Password issue revisited
Date: Mon, 29 Jan 2007 00:32:03 +1030
Message-ID: <45BCACDB.5050702@007Marketing.com> (raw)
In-Reply-To: <BAY114-DAV1235968436BFC871B4AEB7A3A00@phx.gbl>
References: <BAY114-DAV1235968436BFC871B4AEB7A3A00@phx.gbl>
Michael Schmidt wrote:
> Fellow PostgreSQL fans,
> 1. I don't see that this would pose a major security risk. In
> fact, in applications where the user enters the password for each
> session, the password need never be saved to disk, which seems a
> definite security advantage. Some folks have noted that .pgpass is
> a plain text file, hence it could be vulnerable.
Yes it is a plain text file but if you want to use it then you need to
ensure the security is sufficient on the file or it won't be used.
As per the manual -
> The permissions on .pgpass must disallow any access to world or
group; > achieve this by the command chmod 0600 ~/.pgpass. If the
permissions
> are less strict than this, the file will be ignored. (The file
> permissions are not currently checked on Microsoft Windows, however.)
So this security feature should be something that gets added to the
windows version. But otherwise the security of the user's account that
has a .pgpass file is the decider on whether it is vulnerable.
--
Shane Ambler
pgSQL@007Marketing.com
Get Sheeky @ http://Sheeky.Biz
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: pgsql@007Marketing.com, michaelmschmidt@msn.com, pgsql-general@postgresql.org
Subject: Re: Password issue revisited
In-Reply-To: <45BCACDB.5050702@007Marketing.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox