Message-ID: <554A55CA.5000705@gmx.net>
Date: Wed, 06 May 2015 13:56:26 -0400
From: Peter Eisentraut <peter_e@gmx.net>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10;
 rv:31.0) Gecko/20100101 Thunderbird/31.6.0
MIME-Version: 1.0
To: =?UTF-8?B?Vm9sa2VyIEHDn21hbm4=?= <volker.assmann@gmail.com>,
 Robert Haas <robertmhaas@gmail.com>
CC: "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>
Subject: Re: Disabling trust/ident authentication configure option
References: <B01FEF72D29D3AE708989F11@eje.credativ.lan>
	<CA+Tgmobjmp1gDh4eDCSDGMpBF2rPph80108hXWgT7DStcxQb9g@mail.gmail.com>
	<CAJBpAdwvUaK55HCB8FEkzt2GO5cMvwcPmNeqqZThT-=Ra-G6XA@mail.gmail.com>
	<CA+TgmoYFWGoZVCRVpgwGYSiZhY9PFkC0mrmnYy3acFJ=aU0eEw@mail.gmail.com>
 <CAJBpAdwRPX4mzDJM0yLF_gf7d1Ud3mt4MhNO_+Hoz3xBqhSvTQ@mail.gmail.com>
In-Reply-To: 
 <CAJBpAdwRPX4mzDJM0yLF_gf7d1Ud3mt4MhNO_+Hoz3xBqhSvTQ@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

On 5/6/15 6:02 AM, Volker Aßmann wrote:
> Well "trust" actually does not sound that dangerous in case you only
> take a quick glance at the documentation - "trust PostgreSQL to do the
> right thing?"

Hah, we could rename it to "wideopen".

> Please note that the patch does nothing by default, it just adds the
> option to disable trust/ident but leaves them on in the standard
> configuration. I do not want to disable "trust" by default for everyone,
> but it would be great to have the option to do this without having to
> patch (and thus test and verify) the PostgreSQL sources for each new
> release.

Any new compile-time option creates a nonlinear maintenance burden.
We're going to need to test whether each option builds cleanly and
works, also in combination with other options, and on several platforms.
 The authentication code is already littered with build-time
dependencies and platform-specific code.  So the "it doesn't bother
anyone" argument doesn't quite work.

Actually, in this particular case, you wouldn't even need a compile-time
option.  You could just make it a restart-only option.

> I think this is a sufficiently general requirement to warrant including
> an option to disable this, as most hardening guides I have seen for
> PostgreSQL unconditionally require to disable trust authentication and
> disabling it in the code removes the need to check this in the runtime
> configuration.

I think people would be interested in well-thought out, generalized
hardening facilities.  But that would likely include other things than
just disabling an authentication method or two.  And we can't be adding
a new compile-time option as we add each one.  We need a more general
approach.

> Single user sessions would work, but the "peer" authentication is also
> still available and should be the preferred method to reset passwords
> when trust is disabled, so this should not be an issue.

"peer" authentication is unfortunately not quite portable.


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers