From: Christoph Berg <myon@debian.org>
To: Andrew Dunstan <andrew.dunstan@2ndquadrant.com>
Cc: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: Allow 'sslkey' and 'sslcert' in postgres_fdw user mappings
Date: Thu, 9 Jan 2020 13:48:55 +0100
Message-ID: <20200109124855.GD4192@msg.df7cb.de> (raw)
In-Reply-To: <20200109103014.GA4192@msg.df7cb.de>
References: <f941b95e-27ad-cb5c-2495-13c44f90b1bc@2ndQuadrant.com>
<20200109103014.GA4192@msg.df7cb.de>
Re: To Andrew Dunstan 2020-01-09 <20200109103014.GA4192@msg.df7cb.de>
> I believe the options are still used in that case
> for creating connections, even when that means the remote server isn't
> set up for cert auth, which needs password_required=false to succeed.
They are indeed:
stat("/var/lib/postgresql/.postgresql/root.crt", 0x7ffcff3e2bb0) = -1 ENOENT (Datei oder Verzeichnis nicht gefunden)
stat("/foo", 0x7ffcff3e2bb0) = -1 ENOENT (Datei oder Verzeichnis nicht gefunden)
^^^^ sslcert
I'm not sure if that could be exploited in any way, but let's just
forbid it.
Christoph
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: myon@debian.org, andrew.dunstan@2ndquadrant.com, pgsql-hackers@lists.postgresql.org
Subject: Re: Allow 'sslkey' and 'sslcert' in postgres_fdw user mappings
In-Reply-To: <20200109124855.GD4192@msg.df7cb.de>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox