Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1Yq80Z-0004MM-2v for pgsql-hackers@arkaria.postgresql.org; Wed, 06 May 2015 22:41:39 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.80) (envelope-from ) id 1Yq80Y-00056w-GS for pgsql-hackers@arkaria.postgresql.org; Wed, 06 May 2015 22:41:38 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.2:RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from ) id 1Yq80X-00056q-Lu for pgsql-hackers@postgresql.org; Wed, 06 May 2015 22:41:37 +0000 Received: from mx-out.zmailcloud.com ([192.198.85.98] helo=mx-out-1.zmailcloud.com) by magus.postgresql.org with esmtp (Exim 4.84) (envelope-from ) id 1Yq80T-0004Bi-S9 for pgsql-hackers@postgresql.org; Wed, 06 May 2015 22:41:36 +0000 Received: from smtp.01.com (smtp.01.com [10.10.0.43]) by mx-out-1.zmailcloud.com (Postfix) with ESMTP id 0E508563E75; Wed, 6 May 2015 17:41:32 -0500 (CDT) Received: from localhost (localhost [127.0.0.1]) by smtp-out-2.01.com (Postfix) with ESMTP id EBCAF60839; Wed, 6 May 2015 17:41:31 -0500 (CDT) X-Virus-Scanned: amavisd-new at smtp-out-2.01.com Received: from smtp.01.com ([127.0.0.1]) by localhost (smtp-out-2.01.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zQIZwUJ8Qu3I; Wed, 6 May 2015 17:41:31 -0500 (CDT) Received: from smtp.01.com (localhost [127.0.0.1]) by smtp-out-2.01.com (Postfix) with ESMTP id BA7C36083C; Wed, 6 May 2015 17:41:31 -0500 (CDT) Received: from localhost (localhost [127.0.0.1]) by smtp-out-2.01.com (Postfix) with ESMTP id 9AB2C6083B; Wed, 6 May 2015 17:41:31 -0500 (CDT) X-Virus-Scanned: amavisd-new at smtp-out-2.01.com Received: from smtp.01.com ([127.0.0.1]) by localhost (smtp-out-2.01.com [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id LMfFRCrKXUcU; Wed, 6 May 2015 17:41:31 -0500 (CDT) Received: from [172.47.23.104] (50-0-190-244.dsl.dynamic.fusionbroadband.com [50.0.190.244]) by smtp-out-2.01.com (Postfix) with ESMTPSA id 9295860839; Wed, 6 May 2015 17:41:30 -0500 (CDT) Message-ID: <554A9898.9040407@agliodbs.com> Date: Wed, 06 May 2015 15:41:28 -0700 From: Josh Berkus Organization: PostgreSQL Experts Inc. User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.4.0 MIME-Version: 1.0 To: Tom Lane , Andrew Dunstan CC: Robert Haas , Alvaro Herrera , =?UTF-8?B?Vm9sa2VyIEHDn21hbm4=?= , "pgsql-hackers@postgresql.org" Subject: Re: Disabling trust/ident authentication configure option References: <20150506144724.GU2523@alvh.no-ip.org> <554A720F.1030706@dunslane.net> <554A797B.1010101@dunslane.net> <6837.1430946793@sss.pgh.pa.us> In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Pg-Spam-Score: -1.9 (-) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-hackers Precedence: bulk Sender: pgsql-hackers-owner@postgresql.org On 05/06/2015 02:13 PM, Tom Lane wrote: > Andrew Dunstan writes: >> (Personally I think there's a very good case for completely ripping out >> RFC1413 ident auth. I've not seen it used in a great long while, and >> it's always been a security risk.) > > FWIW, I agree with that --- or at least making it a not-built-by-default > option. I have seen it in the last year, actually, but only once, which even for my personal pool represents < 1% usage. So ... > Probably the right time to make any such changes is at the same time > we add the proposed more-secure-than-MD5 password option. +1 to kill off ident when we replace MD5, since users will need to be beaten over the head about changes to auth methods anyway. -- Josh Berkus PostgreSQL Experts Inc. http://pgexperts.com -- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers