pg.ddx.io  pgsql-docs@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Andrew Dunstan <andrew.dunstan@2ndquadrant.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
To: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Andrew Dunstan <andrew@dunslane.net>
Cc: pgsql-hackers@lists.postgresql.org
Subject: Re: initdb recommendations
Date: Mon, 22 Jul 2019 15:20:50 -0400
Message-ID: <5abe622e-78e3-a82c-5f50-3b7295db7056@2ndQuadrant.com> (raw)
In-Reply-To: <12115.1563822921@sss.pgh.pa.us>
References: <bec17f0a-ddb1-8b95-5e69-368d9d0a3390@postgresql.org>
	<f27d3170-76cf-4afb-1e1a-b1059295ec8d@2ndquadrant.com>
	<CABUevExMizVYea9zaHBte66u9KipEgfwcsaE9spfqK9iYRST_g@mail.gmail.com>
	<20190406180839.GA1921989@rfd.leadboat.com>
	<96389374-9454-d26d-6f79-7c7b15ec14bd@2ndquadrant.com>
	<fcd8848c-618c-23d1-2b39-77b13cb2d0a1@2ndquadrant.com>
	<CAOBaU_bTm5M-787dAw=E3OQ13ag_BqOboVWz9xkjQk1=__MwDQ@mail.gmail.com>
	<91f8272f-117f-2a04-862b-871a7b86eeed@2ndquadrant.com>
	<CAOBaU_Y9quphKH98xCgiAXgTYk5xcfTWcyKO-y3o_UJOk0s2uQ@mail.gmail.com>
	<7b6c4220-e5ef-2a13-18ad-af596c52b71a@2ndquadrant.com>
	<23654.1563804669@sss.pgh.pa.us>
	<7886.1563812705@sss.pgh.pa.us>
	<27724.1563813541@sss.pgh.pa.us>
	<12115.1563822921@sss.pgh.pa.us>


On 7/22/19 3:15 PM, Tom Lane wrote:
> I wrote:
>> BTW, it looks like the Windows buildfarm critters have a
>> separate problem: they're failing with
>> initdb: error: must specify a password for the superuser to enable md5 authentication
> I tried doing a run on gaur (old HPUX, so no "peer" auth) before the
> revert happened.  It got as far as initdb-check [1], which failed quite
> thoroughly with lots of the same error as above.  Depressingly, a lot of
> the test cases that expected some type of error "succeeded", indicating
> they're not actually checking to see which error they got.  Boo hiss.
>
> Presumably Noah's AIX menagerie would have failed in about the
> same way if it had run.
>
> So we've got a *lot* of buildfarm work to do before we can think about
> changing this.



Ouch. I'll test more on Windows.



>
> Frankly, this episode makes me wonder whether changing the default is
> even a good idea at this point.  People who care about security have
> already set up their processes to select a useful-to-them auth option,
> while people who do not care are unlikely to be happy about having
> security rammed down their throats, especially if it results in the
> sort of push-ups we're looking at having to do in the buildfarm.
> I think this has effectively destroyed the argument that only
> trivial adjustments will be required.
>
> 			regards, tom lane
>
> [1] https://buildfarm.postgresql.org/cgi-bin/show_log.pl?nm=gaur&dt=2019-07-22%2017%3A08%3A27
>


There's a strong tendency these days to be secure by default, so I
understand the motivation.


cheers


andrew

-- 
Andrew Dunstan                https://www.2ndQuadrant.com
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services






view thread (61+ messages)  latest in thread

Message-ID: <5abe622e-78e3-a82c-5f50-3b7295db7056@2ndQuadrant.com>
Permalink:  ../5abe622e-78e3-a82c-5f50-3b7295db7056@2ndQuadrant.com/
Also on:    postgresql.org/message-id/5abe622e-78e3-a82c-5f50-3b7295db7056@2ndQuadrant.com

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-docs@postgresql.org
  Cc: andrew.dunstan@2ndquadrant.com, tgl@sss.pgh.pa.us, peter.eisentraut@2ndquadrant.com, andrew@dunslane.net, pgsql-hackers@lists.postgresql.org
  Subject: Re: initdb recommendations
  In-Reply-To: <5abe622e-78e3-a82c-5f50-3b7295db7056@2ndQuadrant.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox