From: Nathan Bossart <nathandbossart@gmail.com>
To: Gurjeet Singh <gurjeet@singh.im>
Cc: pgsql-hackers@postgresql.org
Cc: tgl@sss.pgh.pa.us
Subject: Re: harmonize password reuse in vacuumdb, clusterdb, and reindexdb
Date: Wed, 19 Jul 2023 10:43:11 -0700
Message-ID: <20230719174311.GA1186744@nathanxps13> (raw)
In-Reply-To: <20230629052409.GB2049807@nathanxps13>
References: <20230628045741.GA1813397@nathanxps13>
<CABwTF4WB6kYyZzU6Qda_0D7-3SkqzHsVh6q-yscm5FHFQ2F7FQ@mail.gmail.com>
<20230629052409.GB2049807@nathanxps13>
On Wed, Jun 28, 2023 at 10:24:09PM -0700, Nathan Bossart wrote:
> On Wed, Jun 28, 2023 at 09:20:03PM -0700, Gurjeet Singh wrote:
>> The comment on top of connect_utils.c:connectDatabase() seems pertinent:
>>
>>> (Callers should not pass
>>> * allow_password_reuse=true unless reconnecting to the same database+user
>>> * as before, else we might create password exposure hazards.)
>>
>> The callers of {cluster|reindex}_one_database() (which in turn call
>> connectDatabase()) clearly pass different database names in successive
>> calls to these functions. So the patch seems to be in conflict with
>> the recommendation in the comment.
>>
>> [ ... ]
>
> The same commit that added this comment (ff402ae) also set the
> allow_password_reuse parameter to true in vacuumdb's connectDatabase()
> calls. I found a message from the corresponding thread that provides some
> additional detail [0]. I wonder if this comment should instead recommend
> against using the allow_password_reuse flag unless reconnecting to the same
> host/port/user target. Connecting to different databases with the same
> host/port/user information seems okay. Maybe I am missing something...
I added Tom here since it looks like he was the original author of this
comment. Tom, do you have any concerns with updating the comment for
connectDatabase() in src/fe_utils/connect_utils.c like this?
--
Nathan Bossart
Amazon Web Services: https://aws.amazon.com
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: nathandbossart@gmail.com, gurjeet@singh.im, tgl@sss.pgh.pa.us
Subject: Re: harmonize password reuse in vacuumdb, clusterdb, and reindexdb
In-Reply-To: <20230719174311.GA1186744@nathanxps13>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox