Date: Wed, 10 Apr 2019 21:47:01 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Robbie Harwood <rharwood@redhat.com>
Cc: Bruce Momjian <bruce@momjian.us>, Magnus Hagander <magnus@hagander.net>,
	Joe Conway <mail@joeconway.com>,
	Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
	Alvaro Herrera <alvherre@2ndquadrant.com>,
	David Steele <david@pgmasters.net>,
	Michael Paquier <michael@paquier.xyz>,
	Nico Williams <nico@cryptonector.com>,
	PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH v20] GSSAPI encryption support
Message-ID: <20190411014700.GY6197@tamriel.snowman.net>
References: <jlg1tgq1ktm.fsf@thriss.redhat.com>
 <jlgy38mir81.fsf@redhat.com>
 <5ec3f734-810e-36e0-030f-af92efe135da@2ndquadrant.com>
 <20190223162751.GO6197@tamriel.snowman.net>
 <1f799b02-d766-0328-45d6-73e5674d0bc2@2ndquadrant.com>
 <CAOuzzgprZ7-gYkzwkPzMOPka62irppKpXNm219q7a_8Fu33TLw@mail.gmail.com>
 <500b1be7-d0aa-96a2-9982-d748609faff5@joeconway.com>
 <CABUevEyuNNJv=19foa=ycTfTfBUYOEwM8_Uss5OVKrwBAy+Btw@mail.gmail.com>
 <20190409153624.t7cozlctjzuf47ja@momjian.us>
 <jlg7ec3krmt.fsf@redhat.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="Fka8GWmsHUwz9L3n"
Content-Disposition: inline
In-Reply-To: <jlg7ec3krmt.fsf@redhat.com>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--Fka8GWmsHUwz9L3n
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Robbie Harwood (rharwood@redhat.com) wrote:
> Bruce Momjian <bruce@momjian.us> writes:
> > On Wed, Apr  3, 2019 at 08:49:25AM +0200, Magnus Hagander wrote:
> >> On Wed, Apr 3, 2019 at 12:22 AM Joe Conway <mail@joeconway.com> wrote:
> >>
> >> Personally I don't find it as confusing as is either, and I find
> >> hostgss to be a good analog of hostssl. On the other hand hostgssenc
> >> is long and unintuitive. So +1 for leaving as is and -1 one for
> >> changing it IMHO.
> >>=20
> >> I think for those who are well versed in pg_hba (and maybe gss as
> >> well), it's not confusing. That includes me.
> >>=20
> >> However, for a new user, I can definitely see how it can be
> >> considered confusing. And confusion in *security configuration* is
> >> always a bad idea, even if it's just potential.
> >>=20
> >> Thus +1 on changing it.
> >>=20
> >> If it was on the table it might have been better to keep hostgss and
> >> change the authentication method to gssauth or something, but that
> >> ship sailed *years* ago.
> >
> > Uh, did we consider keeping hostgss and changing the auth part at the
> > end to "gssauth"?
>=20
> I think that was implicitly rejected because we'd have to keep the
> capability to configure "gss" there else break compatibility.

Right, if we changed the name of the auth method then everyone who is
using the "gss" auth method would have to update their pg_hba.conf
files...  That would be very ugly.  Also, it wasn't implicitly rejected,
it was discussed up-thread (see the comments between Magnus and I,
specifically, quoted above- "that ship sailed *years* ago") and
explicitly rejected.

Thanks!

Stephen

--Fka8GWmsHUwz9L3n
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJcrpyUAAoJEO1sijiDR2RV48oP/0Zmaa70iN3zVyveMW0LIdhU
ObqPz7mSxA62lytut+oVVwT1LvtBkCRUveKkruxCjaseHdJKI8OPEtZ9Nu8gJcgv
ZMa/2TaQiNn3P5Vtt3w+0Esxwd/B9XivkzEhKw8nn7rI6lZ2v/JiSl4rRAzZQV+1
QqDMAWyD6BBqyStaNd9KVjSWbpt9tX1YTUFhfPSZ1107tRWTe30SbubHoNXZICmS
TAt2EVPHNI52S1Ze17Etkl9VS7aGRplx4U90YAz1+dNIBKWa+vaHKsUoK6dpVXyQ
Rj9lo5o5mZ5vax44/l2obxiVzWgIycO5fUz8fKreCZlsEFW4bekQGJWq3uYxYJ72
Fs+03+rCYcp3Woq8SSVV7FnYW6/8SmH6fNj2yHBuhVd0jSYbruf3jOcnzQuOG1ns
djsKp6hcusFKxqSAPUV2fA8N+9Yec84r3qWZZwOyP1eRjrZ3VPGPYK3zFzkm4kN+
A4FySf+2kzg2COFHETxJeJpZrLLfLACdjJNyiEJRNteM/vNsYThYoTzSXN0i6+28
EyDI14mPbfQIuAH6sftZfWihPvIhyKS7JFemXDr6zs8YNDZ7AQ0ftETs6MOG76OQ
rYIofUNToZul7jcXg0b8in6jZHvNwTkbvRpBZEyGxzC5KTrsKocpKlyqri7DMXIp
RAd+v+lKobEahrdEEXWO
=0Oig
-----END PGP SIGNATURE-----

--Fka8GWmsHUwz9L3n--