MIME-Version: 1.0
References: <CAFsaSDgSPjLOmk51fZt_zYPEUnFOCQ+92g_g2OSMjNbMa4h2xg@mail.gmail.com>
 <CAKAnmmLBf33oSKxxANDztHR455BhEdO=AROGvXZa1crh7VchHg@mail.gmail.com>
 <CANzqJaDJ0_Aiih6X6AMfkRaWATFrHJMw_21oS-7im8JdN9SgrQ@mail.gmail.com>
 <20241213202348.jtchbb2lezbx2re6@hjp.at> <CAFsaSDgsJB9WpZSxspQ0CJAkT4OjGzdh+hLqnf=hinp-ywDU6g@mail.gmail.com>
 <CANzqJaCww31LJXPQhPaHDDedJ+RAHp4U99bLs4wBHMU4SPZQLg@mail.gmail.com>
 <20241216151853.ecl37fqyhwmcdi7i@hjp.at> <CANzqJaBenxrGQRb8muLHPs81aZqmaju+S_1ThNYV0Uf-rov84w@mail.gmail.com>
 <20241217183911.semgtdmuhxp2ajv7@hjp.at>
In-Reply-To: <20241217183911.semgtdmuhxp2ajv7@hjp.at>
From: Ron Johnson <ronljohnsonjr@gmail.com>
Date: Tue, 17 Dec 2024 13:47:24 -0500
Message-ID: <CANzqJaA=7vZ-qud1zq8ascpRLtiaJaygp4ap_x64dVb4YcQuag@mail.gmail.com>
Subject: Re: Credcheck- credcheck.max_auth_failure
To: pgsql-general@lists.postgresql.org
Content-Type: multipart/alternative; boundary="00000000000003e4ee06297bbb17"
Archived-At: <https://www.postgresql.org/message-id/CANzqJaA%3D7vZ-qud1zq8ascpRLtiaJaygp4ap_x64dVb4YcQuag%40mail.gmail.com>
Precedence: bulk

--00000000000003e4ee06297bbb17
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Tue, Dec 17, 2024 at 1:39=E2=80=AFPM Peter J. Holzer <hjp-pgsql@hjp.at> =
wrote:

> On 2024-12-16 10:37:59 -0500, Ron Johnson wrote:
> > On Mon, Dec 16, 2024 at 10:19=E2=80=AFAM Peter J. Holzer <hjp-pgsql@hjp=
.at>
> wrote:
> >
> >     On 2024-12-16 09:17:25 -0500, Ron Johnson wrote:
> >     > Local (socket-based) connections are typically peer-authenticated
> >     > (meaning that authentication is handled by Linux pam).
> >                                          ^^^
> >     Is it? I haven't checked the source code, but this doesn't seem
> >     plausible. You can get the uid of a socket peer directly from the
> >     kernel, which can be converted to a user name via getpwuid, and the
> >     mapping to postgresql roles is done via pg_ident.conf. I see no rol=
e
> for
> >     PAM in that path.
> >
> >
> > https://www.postgresql.org/docs/16/auth-peer.html
> >
> > "
> > The peer authentication method works by obtaining the client's operatin=
g
> system
> > user name from the kernel and using it as the allowed database user nam=
e
> (with
> > optional user name mapping). This method is only supported on local
> > connections.
> > [snip]
> > Peer authentication is only available on operating systems providing th=
e
> > getpeereid() function, the SO_PEERCRED socket parameter, or similar
> mechanisms.
> > Currently that includes Linux, most flavors of BSD including macOS,
> and Solaris
> > .
> > "
> >
> > That means pam
>
> No, it doesn't. PAM is used to authenticate a user to the OS (plus to do
> a bit of setup and teardown at the beginning and end of each session).
> But here the user is already authenticated to the OS and postgresql is
> using that information to authenticate the user to itself. This will use
> the nsswitch mechanism on Linux (and probably something similar on the
> other OSs) to do the uid->username lookup, but it will not use PAM,
> since that simply isn't what PAM is for (or capable of to my knowledge).
>

pam is _indirectly_ used, since like you said, that's what authenticates
the OS user that "peer" authentication needs.


--=20
Death to <Redacted>, and butter sauce.
Don't boil me, I'm still alive.
<Redacted> lobster!

--00000000000003e4ee06297bbb17
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Tue, Dec 17, 2024 at 1:39=E2=80=AFPM P=
eter J. Holzer &lt;<a href=3D"mailto:hjp-pgsql@hjp.at">hjp-pgsql@hjp.at</a>=
&gt; wrote:</div><div class=3D"gmail_quote gmail_quote_container"><blockquo=
te class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px =
solid rgb(204,204,204);padding-left:1ex">On 2024-12-16 10:37:59 -0500, Ron =
Johnson wrote:<br>
&gt; On Mon, Dec 16, 2024 at 10:19=E2=80=AFAM Peter J. Holzer &lt;<a href=
=3D"mailto:hjp-pgsql@hjp.at" target=3D"_blank">hjp-pgsql@hjp.at</a>&gt; wro=
te:<br>
&gt; <br>
&gt;=C2=A0 =C2=A0 =C2=A0On 2024-12-16 09:17:25 -0500, Ron Johnson wrote:<br=
>
&gt;=C2=A0 =C2=A0 =C2=A0&gt; Local (socket-based) connections are typically=
 peer-authenticated<br>
&gt;=C2=A0 =C2=A0 =C2=A0&gt; (meaning that authentication is handled by Lin=
ux pam).<br>
&gt;=C2=A0 =C2=A0 =C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0^^^<br>
&gt;=C2=A0 =C2=A0 =C2=A0Is it? I haven&#39;t checked the source code, but t=
his doesn&#39;t seem<br>
&gt;=C2=A0 =C2=A0 =C2=A0plausible. You can get the uid of a socket peer dir=
ectly from the<br>
&gt;=C2=A0 =C2=A0 =C2=A0kernel, which can be converted to a user name via g=
etpwuid, and the<br>
&gt;=C2=A0 =C2=A0 =C2=A0mapping to postgresql roles is done via pg_ident.co=
nf. I see no role for<br>
&gt;=C2=A0 =C2=A0 =C2=A0PAM in that path.<br>
&gt; <br>
&gt; <br>
&gt; <a href=3D"https://www.postgresql.org/docs/16/auth-peer.html" rel=3D"n=
oreferrer" target=3D"_blank">https://www.postgresql.org/docs/16/auth-peer.h=
tml</a><br>
&gt; <br>
&gt; &quot;<br>
&gt; The peer authentication method works by obtaining the client&#39;s ope=
rating system<br>
&gt; user name from the kernel and using it as the allowed database user na=
me (with<br>
&gt; optional user name mapping). This method is only supported on local<br=
>
&gt; connections.<br>
&gt; [snip]<br>
&gt; Peer authentication is only available on operating systems providing t=
he=C2=A0<br>
&gt; getpeereid()=C2=A0function, the=C2=A0SO_PEERCRED=C2=A0socket parameter=
, or similar mechanisms.<br>
&gt; Currently that includes=C2=A0Linux, most flavors of=C2=A0BSD=C2=A0incl=
uding=C2=A0macOS, and=C2=A0Solaris<br>
&gt; .<br>
&gt; &quot;<br>
&gt; <br>
&gt; That means pam<br>
<br>
No, it doesn&#39;t. PAM is used to authenticate a user to the OS (plus to d=
o<br>
a bit of setup and teardown at the beginning and end of each session).<br>
But here the user is already authenticated to the OS and postgresql is<br>
using that information to authenticate the user to itself. This will use<br=
>
the nsswitch mechanism on Linux (and probably something similar on the<br>
other OSs) to do the uid-&gt;username lookup, but it will not use PAM,<br>
since that simply isn&#39;t what PAM is for (or capable of to my knowledge)=
.<br></blockquote><div><br></div><div>pam is _indirectly_ used, since like =
you said, that&#39;s what authenticates the OS user that &quot;peer&quot; a=
uthentication needs.=C2=A0</div></div><div><br clear=3D"all"></div><div><br=
></div><span class=3D"gmail_signature_prefix">-- </span><br><div dir=3D"ltr=
" class=3D"gmail_signature"><div dir=3D"ltr">Death to &lt;Redacted&gt;, and=
 butter sauce.<div>Don&#39;t boil me, I&#39;m still alive.<br><div><div>&lt=
;Redacted&gt; lobster!</div></div></div></div></div></div>

--00000000000003e4ee06297bbb17--