Date: Wed, 20 May 2015 19:46:12 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Andres Freund <andres@anarazel.de>
Cc: Josh Berkus <josh@agliodbs.com>, Tom Lane <tgl@sss.pgh.pa.us>,
 Alvaro Herrera <alvherre@2ndquadrant.com>,
 Volker =?iso-8859-1?Q?A=DFmann?= <volker.assmann@gmail.com>,
 Robert Haas <robertmhaas@gmail.com>, Andrew Dunstan <andrew@dunslane.net>,
 "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>
Subject: Re: Disabling trust/ident authentication configure option
Message-ID: <20150520234612.GO26667@tamriel.snowman.net>
References: <CB1A1AB6-B345-4ED7-A705-D87E4DC99E11@gmail.com>
 <CAJBpAdzH3pMTFfBE+dYd+OytVJXR2XF=ESQ7TG6syjB1suh2ZQ@mail.gmail.com>
 <WM!22b0c9d0d605588edea2c700c71c4e0b51033b37a1185be38d4160d6de08c76eba51fd2754a9d1446b4cfb3fccceb9ce!@asav-2.01.com>
 <555CC5DE.3050707@agliodbs.com>
 <20150520175916.GB5885@postgresql.org>
 <23809.1432145430@sss.pgh.pa.us>
 <WM!6a10d1d9bf3d237078cee58af8aba8eb1f4eb065a68f02eece6d9cc0dfc8c8357d255d0f6f5ccadf019b03dbf1877c5d!@asav-2.01.com>
 <555CDC56.5050607@agliodbs.com>
 <20150520194223.GM26667@tamriel.snowman.net>
 <20150520215444.GR27868@alap3.anarazel.de>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature"; boundary="U0B5otXy6WXfork9"
Content-Disposition: inline
In-Reply-To: <20150520215444.GR27868@alap3.anarazel.de>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--U0B5otXy6WXfork9
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Andres,

* Andres Freund (andres@anarazel.de) wrote:
> On 2015-05-20 15:42:23 -0400, Stephen Frost wrote:
> > > So the first thing to establish is "other than Volker himself, who are
> > > we helping here?"
> >=20
> > I don't agree with this either.  Providing a "bypass all authentication"
> > configuration option really isn't a good thing.  Why don't packagers use
> > our default pg_hba.conf?  Because it only makes sense in a development
> > type of environment.  I'd argue the same is true for 'trust'.
>=20
> Uh. So if the shit hit the fan because you mismanaged a password
> rollover, kereberos is down, or something like that, and you can't
> access postgres anymore you want to recompile? And no peer isn't an
> answer isn't an answer, it's not available on windows. Your only way out
> is going to be single user mode. But wait, that's a security hole too.

Apologies for not being clearer.  I agree that we need an alternative
for addressing this use-case before we can consider getting rid of
'trust' or not having it built into the binaries which are distributed.

In other words, I agree with you that we can't simply get rid of 'trust'
without having another solution.  I *do* believe that a real single-user
mode that is only available to the owner of the cluster would go a long
way towards this goal.  If 'trust' was only able to be used by the owner
of the database, I'd have much less of an issue with it.

> I find the arguments presented in this thread for a configure option
> entirely unconvincing. If you'd argued for a saner default
> authentication setup: I'd be on board with that. But this seems just a
> pointless exercise in making things more complicated.

Thankfully, the packagers have already addressed the insecure default
that the source build provides for pg_hba.conf and so we don't need to
worry about it (except perhaps for new distributions or new packagers,
but I hope they'll usually look at the existing packages and not just
distribute what we provide as the default pg_hba.conf).

	Thanks!

		Stephen

--U0B5otXy6WXfork9
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJVXRzEAAoJEO1sijiDR2RV31EP/1hdKOvbwg+rKqYSVzeS3GSY
/DH1dORs1QzI8HjiDqc8HgFkrh5wFXOwMqKNy+Yhemkh9zJBy4zpV8AtSqYFckNJ
YNNAFMawpc5ufZuCvQPh1CXRQD88JZUkEX37SSrw/QdzQmuVO//rDi+YHCDDMIbj
rl0tOJRg5A+X2jbfACkbbE2od2i4Ojl7nOo+iOTsYahT8a8JtYNVmISsnOuWLsuJ
3Py3ZWhEjNUPJXfsbzGja5zKdVdbB9zlKIxpNHpkCfzaszYUk/rl3cZNf8hUXxNp
/FFGokXZPFTase0eatCgrXXAB9KOgT3EpJe4dlWzEk+fAvkNeAQwBQC+PeWNEvGi
5WbetqmaW+OYJtN5AhXXNaxwbgC2RvrQ79naQJNaNn8I0i8vF/oShBP5x5XkPKri
RR1q36fuCfSkBVVc7/it3kYdxxf3PZb1ZWV9T+h2fspHpSv3ItGPAoPSSVCdwb5g
P45avnq9PXfyanxOj23HxiUpovZvv/uddQcQOWm1fY5CXB8n6gZ+eSvSXryUK49e
emBv4vf32yPPk56kNGRrtfDvCzKLG6i12DfxmGCKmltPf37872Yf8udxzicKOjXP
69/oDrU9rWHi0Dj3g1LlKEe2RT1ek3hhdoDCuTKyMkgFxtxLGoSvlfnCtpcvg1Fr
zMbA0Y5LLTlHINtivB1Q
=3RE0
-----END PGP SIGNATURE-----

--U0B5otXy6WXfork9--