Date: Thu, 7 May 2015 11:02:54 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Josh Berkus <josh@agliodbs.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, Andrew Dunstan <andrew@dunslane.net>,
 Robert Haas <robertmhaas@gmail.com>,
 Alvaro Herrera <alvherre@2ndquadrant.com>,
 Volker =?iso-8859-1?Q?A=DFmann?= <volker.assmann@gmail.com>,
 "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>
Subject: Re: Disabling trust/ident authentication configure option
Message-ID: <20150507150254.GA30322@tamriel.snowman.net>
References: 
 <CA+Tgmobjmp1gDh4eDCSDGMpBF2rPph80108hXWgT7DStcxQb9g@mail.gmail.com>
 <CAJBpAdwvUaK55HCB8FEkzt2GO5cMvwcPmNeqqZThT-=Ra-G6XA@mail.gmail.com>
 <CA+TgmoYFWGoZVCRVpgwGYSiZhY9PFkC0mrmnYy3acFJ=aU0eEw@mail.gmail.com>
 <20150506144724.GU2523@alvh.no-ip.org>
 <554A720F.1030706@dunslane.net>
 <CA+TgmoZMX3FvHnnXcuiTTuh=6WY2uW6=QmRWkkNdUwD1T5Zh6g@mail.gmail.com>
 <554A797B.1010101@dunslane.net> <6837.1430946793@sss.pgh.pa.us>
 <WM!166b48023e720856eea587c0ad127e5181882abf659ccd483360b19f27293d1addb1d058c6dbdafcbaa946420b35a64b!@asav-3.01.com>
 <554A9898.9040407@agliodbs.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature"; boundary="/F9JGmC61DzSMvII"
Content-Disposition: inline
In-Reply-To: <554A9898.9040407@agliodbs.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--/F9JGmC61DzSMvII
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

* Josh Berkus (josh@agliodbs.com) wrote:
> On 05/06/2015 02:13 PM, Tom Lane wrote:
> > Andrew Dunstan <andrew@dunslane.net> writes:
> >> (Personally I think there's a very good case for completely ripping ou=
t=20
> >> RFC1413 ident auth. I've not seen it used in a great long while, and=
=20
> >> it's always been a security risk.)
> >=20
> > FWIW, I agree with that --- or at least making it a not-built-by-default
> > option.
>=20
> I have seen it in the last year, actually, but only once, which even for
> my personal pool represents < 1% usage.  So ...
>=20
> > Probably the right time to make any such changes is at the same time
> > we add the proposed more-secure-than-MD5 password option.
>=20
> +1 to kill off ident when we replace MD5, since users will need to be
> beaten over the head about changes to auth methods anyway.

I realize it's not going to be popular, but I'd love to have 'trust'
only allowed if a command-line option is passed to the postmaster or
something along those lines.  It's really got no business being an
option for a network service like PG.  I'd suggest ripping it out
entirely but I'm sure that'd be even less popular and Andrew does make a
good point that our single-user-mode is still so terrible that we have
to support a multi-user-mode with zero auth, to deal with certain kinds
of breakage/corruption.  The fix for that is having a real single-user
mode that is usable, as has been discussed previously, but we don't seem
to be making much progress in that direction, unfortunately.

	Thanks!

		Stephen

--/F9JGmC61DzSMvII
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJVS36eAAoJEO1sijiDR2RV7lYQALf9UR9LB0GBRchJicMvMZTE
KdQQM3ZNxVwyCsLCRRqMxnEUcgGYCR1/ZKiG/PF1I8sWwwhizUGVmm5VDPQccYg/
iBcpI/qknlbTAXrXWuq/R8dUrVSsNpySS8LAKrcmAUIeVingzATxwZVa6xbPpWXc
imMYGMJchltC/bwg4cJGMqQAdBH+ENJLlVcHzu4E5QzR6AZnoIeexs/X6uT9+cQH
fes8CKLTOe1+ORA7bVIaX8+HWRfNsWrO1ASjhLMKrDySJC3RslOYBAdZDbZOCYvM
2pU3qwZ3va1CNKAmUWpT2QNYzyPux3sD5oWWOjjKV0v8JKjrxr6a0YEDQhJrlG6h
wsR6tmfR+iUzQtGQAfXi9rzedbCDFzZau3BXUIPaBbiQevSqcnPddZ+rvemaPonU
H0xdaWdEYjXCLR5F0eQEgKFvFxivhqI8kjm5bq43BSiVDWZ9iDppDslJtgjwayjd
wy+nUAi4iM2zlUUrIR+nFX8gbj9DQi9HT6edwcOjoewR4A/2stLWfno/gFLxyuI+
gBIKX1CiVDs7JUdhgpw8hb26k1MGRMfq0M1uu8wHjJ1hkQ1z3xL7j0UCgmR96P7b
xIQyW07bcL5YWfmOz1JuzM8ydGdHJnJuj6aTqcPo8UDM17C1BOq0X42ql4MAE+fG
A34H+e11KcjlXes5qMct
=ddp/
-----END PGP SIGNATURE-----

--/F9JGmC61DzSMvII--