From: Andrew Dunstan <andrew@dunslane.net>
To: Alvaro Herrera <alvherre@2ndquadrant.com>
To: Robert Haas <robertmhaas@gmail.com>
Cc: Volker Aßmann <volker.assmann@gmail.com>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Subject: Re: Disabling trust/ident authentication configure option
Date: Wed, 06 May 2015 15:57:03 -0400
Message-ID: <554A720F.1030706@dunslane.net> (raw)
In-Reply-To: <20150506144724.GU2523@alvh.no-ip.org>
References: <B01FEF72D29D3AE708989F11@eje.credativ.lan>
<CA+Tgmobjmp1gDh4eDCSDGMpBF2rPph80108hXWgT7DStcxQb9g@mail.gmail.com>
<CAJBpAdwvUaK55HCB8FEkzt2GO5cMvwcPmNeqqZThT-=Ra-G6XA@mail.gmail.com>
<CA+TgmoYFWGoZVCRVpgwGYSiZhY9PFkC0mrmnYy3acFJ=aU0eEw@mail.gmail.com>
<20150506144724.GU2523@alvh.no-ip.org>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
On 05/06/2015 10:47 AM, Alvaro Herrera wrote:
>
> I don't necessarily agree with the patch as proposed. I would rather
> have a comma-separated list of methods, as in:
>
> --disable-auth=ident,peer
>
> which lets you choose what to disable without hardcoded choices. Due to
> the nature of autoconf, this might be too fiddly to implement, though,
> and if so I think the method proposed by this patch seems a reasonable
> compromise. I've seen configure in other programs offer options such as
> --disable-foo=list that lists acceptable values (or --disable-foo=help)
>
I don't necessarily object to this idea, but I do think we need to
ensure that we don't allow both trust and peer to be disabled (which
means on Windows you would not be able to disable trust). Otherwise this
becomes a footgun which would require the whole server to be stopped so
you could connect in single user mode to correct certain mistakes, which
are unfortunately all too common.
cheers
andrew
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: andrew@dunslane.net, alvherre@2ndquadrant.com, robertmhaas@gmail.com, volker.assmann@gmail.com
Subject: Re: Disabling trust/ident authentication configure option
In-Reply-To: <554A720F.1030706@dunslane.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox