Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1ipXFJ-000198-3g for pgsql-hackers@arkaria.postgresql.org; Thu, 09 Jan 2020 12:49:05 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1ipXFF-0000om-Tn for pgsql-hackers@arkaria.postgresql.org; Thu, 09 Jan 2020 12:49:01 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1ipXFF-0000mx-ED for pgsql-hackers@lists.postgresql.org; Thu, 09 Jan 2020 12:49:01 +0000 Received: from feynman.df7cb.de ([195.49.152.168]) by makus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1ipXFB-0006Fv-Vo for pgsql-hackers@lists.postgresql.org; Thu, 09 Jan 2020 12:49:00 +0000 Received: from msg.df7cb.de (unknown [IPv6:2003:5b:203b:100:7627:eaff:fe52:8e03]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by feynman.df7cb.de (Postfix) with ESMTPSA id 47tmBv6Ql3z3F02; Thu, 9 Jan 2020 13:48:55 +0100 (CET) Date: Thu, 9 Jan 2020 13:48:55 +0100 From: Christoph Berg To: Andrew Dunstan Cc: PostgreSQL Hackers Subject: Re: Allow 'sslkey' and 'sslcert' in postgres_fdw user mappings Message-ID: <20200109124855.GD4192@msg.df7cb.de> References: <20200109103014.GA4192@msg.df7cb.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20200109103014.GA4192@msg.df7cb.de> List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk Re: To Andrew Dunstan 2020-01-09 <20200109103014.GA4192@msg.df7cb.de> > I believe the options are still used in that case > for creating connections, even when that means the remote server isn't > set up for cert auth, which needs password_required=false to succeed. They are indeed: stat("/var/lib/postgresql/.postgresql/root.crt", 0x7ffcff3e2bb0) = -1 ENOENT (Datei oder Verzeichnis nicht gefunden) stat("/foo", 0x7ffcff3e2bb0) = -1 ENOENT (Datei oder Verzeichnis nicht gefunden) ^^^^ sslcert I'm not sure if that could be exploited in any way, but let's just forbid it. Christoph