Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hwErN-0001Yr-JW for pgsql-hackers@arkaria.postgresql.org; Sat, 10 Aug 2019 00:03:49 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1hwErL-0003eq-Qs for pgsql-hackers@arkaria.postgresql.org; Sat, 10 Aug 2019 00:03:47 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hwErL-0003eW-Ho for pgsql-hackers@lists.postgresql.org; Sat, 10 Aug 2019 00:03:47 +0000 Received: from tamriel.snowman.net ([96.255.250.162]) by magus.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1hwErE-0003a1-Ru; Sat, 10 Aug 2019 00:03:46 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id 3E1EB5F79F; Fri, 9 Aug 2019 20:03:40 -0400 (EDT) Date: Fri, 9 Aug 2019 20:03:40 -0400 From: Stephen Frost To: Jeff Davis Cc: Heikki Linnakangas , "Jonathan S. Katz" , Michael Paquier , pgsql-hackers@postgresql.org Subject: Re: Add "password_protocol" connection parameter to libpq Message-ID: <20190810000340.GT16436@tamriel.snowman.net> References: <227015d8417f2b4fef03f8966dbfa5cbcc4f44da.camel@j-davis.com> <20190809030021.GG3194@paquier.xyz> <3bbf5968ea705700a2605d6db74d8510bea7940b.camel@j-davis.com> <20190809100922.GI3194@paquier.xyz> <20190809132850.GL16436@tamriel.snowman.net> <609482826475e0063c7d71b2449ae31c0d61b232.camel@j-davis.com> <071e45a6-97f7-1614-371c-98ecb03aed65@postgresql.org> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="u+FGODhbLwgAeSOU" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.24 (2015-08-30) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --u+FGODhbLwgAeSOU Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Greetings, * Jeff Davis (pgsql@j-davis.com) wrote: > On Sat, 2019-08-10 at 00:17 +0300, Heikki Linnakangas wrote: > > auth_methods =3D 'MITM, -password, -md5' >=20 > Keep in mind this is client configuration, so something reasonable in > postgresql.conf might not be so reasonable in the form: Yeah, that's a really good point. > postgresql://foo:secret@myhost/mydb?auth_methods=3DMITM%2C%20- > password%2C%20-md5 >=20 > Another thing to consider is that there's less control configuring on > the client than on the server. The server will send at most one > authentication request based on its own rules, and all the client can > do is either answer it, or disconnect. And the SSL stuff all happens > before that, and won't use an authentication request message at all. Note that GSSAPI Encryption works the same as SSL in this regard. Thanks, Stephen --u+FGODhbLwgAeSOU Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJdTgnbAAoJEO1sijiDR2RVGykQAJeTA6c5/polVMtzX0KxlVFQ phMedHTPSURvbm5LY4CvJL5EBvxgA9zuZtJxDA5JPpdDjnqKamryEF175Tx8McV4 vSL1BOZEzD/KUlN7l7MFu7Gvj97j8+D3vvCfaRr9gtWVeVQ0fFOKsidhjCTcPiDH 62G9nHXFxvcJpEmpFF7giZbGgNimD00WxUqLcVLhdrZVNCFs5tdMW4bz8cV4uU+z ZRqRXQ/U8X8AIaKNJM1Kkb14UlyAR6NzQI0feHd+QI2auqflHTRGfJ1KZ+XTz4O4 LkyI8L7mdg9aCJMMQQ5qalf6rVel5x/Sz77Y1SWnIdyjZ6sGkJR7UGoHGqKcQ1hV tMC4k9Fb/08q3q7Gf7ikGf412W/n0XvCuy9/B4gJ70ns5/faaYK3AKFF7u3s94Zq qgJEBHIsw/nL80xAvS+TPHm9q+/eMHBuQUTD4YHzXZJMKLS4cfJACizDWqyIxTQD 2KyixnPLeUyf0lswcRbzUfYp+NsB4r24dILkSFU/aOOdnbDCQoR2xd/06J+6J7vx FFjqmwj/mW+bYK2d4WiDs4+3yWLuAUoSvLOO1n3gBYFpsl47JpxbynBgOPANveiV lokYpqbsTz3iXDDU/ButcsDpYMXb5Mq0S0eIDLGxh/XNPo5eUFggbg1RT/ODNTK0 bfGZqdHrQaga9NWVr4wo =YmeG -----END PGP SIGNATURE----- --u+FGODhbLwgAeSOU--