Date: Wed, 20 May 2015 19:05:41 -0300
From: Alvaro Herrera <alvherre@2ndquadrant.com>
To: Andres Freund <andres@anarazel.de>
Cc: Stephen Frost <sfrost@snowman.net>, Josh Berkus <josh@agliodbs.com>,
 Tom Lane <tgl@sss.pgh.pa.us>,
 Volker =?iso-8859-1?Q?A=DFmann?= <volker.assmann@gmail.com>,
 Robert Haas <robertmhaas@gmail.com>, Andrew Dunstan <andrew@dunslane.net>,
 "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>
Subject: Re: Disabling trust/ident authentication configure option
Message-ID: <20150520220541.GJ5885@postgresql.org>
References: <CB1A1AB6-B345-4ED7-A705-D87E4DC99E11@gmail.com>
 <CAJBpAdzH3pMTFfBE+dYd+OytVJXR2XF=ESQ7TG6syjB1suh2ZQ@mail.gmail.com>
 <WM!22b0c9d0d605588edea2c700c71c4e0b51033b37a1185be38d4160d6de08c76eba51fd2754a9d1446b4cfb3fccceb9ce!@asav-2.01.com>
 <555CC5DE.3050707@agliodbs.com>
 <20150520175916.GB5885@postgresql.org>
 <23809.1432145430@sss.pgh.pa.us>
 <WM!6a10d1d9bf3d237078cee58af8aba8eb1f4eb065a68f02eece6d9cc0dfc8c8357d255d0f6f5ccadf019b03dbf1877c5d!@asav-2.01.com>
 <555CDC56.5050607@agliodbs.com>
 <20150520194223.GM26667@tamriel.snowman.net>
 <20150520215444.GR27868@alap3.anarazel.de>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <20150520215444.GR27868@alap3.anarazel.de>
User-Agent: Mutt/1.5.23 (2014-03-12)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

Andres Freund wrote:
> On 2015-05-20 15:42:23 -0400, Stephen Frost wrote:
> > > So the first thing to establish is "other than Volker himself, who are
> > > we helping here?"
> > 
> > I don't agree with this either.  Providing a "bypass all authentication"
> > configuration option really isn't a good thing.  Why don't packagers use
> > our default pg_hba.conf?  Because it only makes sense in a development
> > type of environment.  I'd argue the same is true for 'trust'.
> 
> Uh. So if the shit hit the fan because you mismanaged a password
> rollover, kereberos is down, or something like that, and you can't
> access postgres anymore you want to recompile?

Yeah, it's pretty messy.  I thought about providing the feature without
involving configure: say have a file listing allowed auth methods; in
Volker's case it's easy to ship packages were trust/peer are removed in
the file.  If you're in deep trouble just enable trust there and fix it.
But this has the exact problem we started with: the lazy admin will just
enable it "momentarily" to get the thing running and forget to turn it
off later.

I was thinking that another use for this would be cases where an auth
method is found to be insecure and you want to disable it completely
(say Kerberos is cracked irreparably or whatever).  But the real
solution to that problem is to remove it from pg_hba.conf.  In the end,
it seems there is no actual hole being solved here that cannot be
better attacked by other means.

-- 
Álvaro Herrera                http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers