pg.ddx.io  pgsql-docs@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Andres Freund <andres@anarazel.de>
Cc: Andrew Dunstan <andrew.dunstan@2ndquadrant.com>
Cc: pgsql-hackers@lists.postgresql.org
Subject: Re: initdb recommendations
Date: Wed, 24 Jul 2019 16:18:34 -0400
Message-ID: <6528.1563999514@sss.pgh.pa.us> (raw)
In-Reply-To: <29164e47-8dfb-4737-2a61-e67a18f847f3@2ndquadrant.com>
References: <20190406180839.GA1921989@rfd.leadboat.com>
	<96389374-9454-d26d-6f79-7c7b15ec14bd@2ndquadrant.com>
	<fcd8848c-618c-23d1-2b39-77b13cb2d0a1@2ndquadrant.com>
	<CAOBaU_bTm5M-787dAw=E3OQ13ag_BqOboVWz9xkjQk1=__MwDQ@mail.gmail.com>
	<91f8272f-117f-2a04-862b-871a7b86eeed@2ndquadrant.com>
	<CAOBaU_Y9quphKH98xCgiAXgTYk5xcfTWcyKO-y3o_UJOk0s2uQ@mail.gmail.com>
	<7b6c4220-e5ef-2a13-18ad-af596c52b71a@2ndquadrant.com>
	<23654.1563804669@sss.pgh.pa.us>
	<7886.1563812705@sss.pgh.pa.us>
	<c0ccc036-8e58-f057-304f-9feb8f6ec80c@2ndQuadrant.com>
	<20190722174042.zb6dgvbymwxidltv@alap3.anarazel.de>
	<29164e47-8dfb-4737-2a61-e67a18f847f3@2ndquadrant.com>

Peter Eisentraut <peter.eisentraut@2ndquadrant.com> writes:
> If I'm logged in as the OS user that owns the data directory, I should
> be able to log in to the database system via local socket as any user.
> Because why stop me?  I can just change pg_hba.conf to let me in.

Hmm ... there's probably some minor loss of safety there, but not
much, as you say.

> I think we could just define that if geteuid == getpeereid, then
> authentication succeeds.  Possibly make that a setting if someone wants
> to turn it off.

We would still need to make the proposed buildfarm changes, though,
because Windows.  (And HPUX, though if it were the only holdout
maybe we could consider blowing it off.)

I'm not that excited about weakening our authentication rules
just to make things easier for the buildfarm.

It's possible that what you suggest is a good idea anyway to reduce
the user impact of switching from trust to peer as default auth.
However, I'm a little worried that we'll start getting a lot of "it
works in psql but I can't connect via JDBC-or-whatever" complaints.
So I dunno if it will really make things easier for users.

			regards, tom lane





view thread (61+ messages)  latest in thread

Message-ID: <6528.1563999514@sss.pgh.pa.us>
Permalink:  ../6528.1563999514@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/6528.1563999514@sss.pgh.pa.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-docs@postgresql.org
  Cc: tgl@sss.pgh.pa.us, peter.eisentraut@2ndquadrant.com, andres@anarazel.de, andrew.dunstan@2ndquadrant.com, pgsql-hackers@lists.postgresql.org
  Subject: Re: initdb recommendations
  In-Reply-To: <6528.1563999514@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox