Message-ID: <554A720F.1030706@dunslane.net>
Date: Wed, 06 May 2015 15:57:03 -0400
From: Andrew Dunstan <andrew@dunslane.net>
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
 rv:31.0) Gecko/20100101 Thunderbird/31.2.0
MIME-Version: 1.0
To: Alvaro Herrera <alvherre@2ndquadrant.com>,
 Robert Haas <robertmhaas@gmail.com>
CC: =?windows-1252?Q?Volker_A=DFmann?= <volker.assmann@gmail.com>,
 "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>
Subject: Re: Disabling trust/ident authentication configure option
References: <B01FEF72D29D3AE708989F11@eje.credativ.lan>
 <CA+Tgmobjmp1gDh4eDCSDGMpBF2rPph80108hXWgT7DStcxQb9g@mail.gmail.com>
 <CAJBpAdwvUaK55HCB8FEkzt2GO5cMvwcPmNeqqZThT-=Ra-G6XA@mail.gmail.com>
 <CA+TgmoYFWGoZVCRVpgwGYSiZhY9PFkC0mrmnYy3acFJ=aU0eEw@mail.gmail.com>
 <20150506144724.GU2523@alvh.no-ip.org>
In-Reply-To: <20150506144724.GU2523@alvh.no-ip.org>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


On 05/06/2015 10:47 AM, Alvaro Herrera wrote:

>
> I don't necessarily agree with the patch as proposed.  I would rather
> have a comma-separated list of methods, as in:
>
>      --disable-auth=ident,peer
>
> which lets you choose what to disable without hardcoded choices.  Due to
> the nature of autoconf, this might be too fiddly to implement, though,
> and if so I think the method proposed by this patch seems a reasonable
> compromise.  I've seen configure in other programs offer options such as
> --disable-foo=list that lists acceptable values (or --disable-foo=help)
>


I don't necessarily object to this idea, but I do think we need to 
ensure that we don't allow both trust and peer to be disabled (which 
means on Windows you would not be able to disable trust). Otherwise this 
becomes a footgun which would require the whole server to be stopped so 
you could connect in single user mode to correct certain mistakes, which 
are unfortunately all too common.

cheers

andrew


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers