Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1YuNJJ-0001nH-Co for pgsql-hackers@arkaria.postgresql.org; Mon, 18 May 2015 15:50:33 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.80) (envelope-from ) id 1YuNJI-0007ra-Om for pgsql-hackers@arkaria.postgresql.org; Mon, 18 May 2015 15:50:32 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.2:RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from ) id 1YuNJG-0007pA-Va for pgsql-hackers@postgresql.org; Mon, 18 May 2015 15:50:31 +0000 Received: from relay4-d.mail.gandi.net ([2001:4b98:c:538::196]) by magus.postgresql.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.84) (envelope-from ) id 1YuNJD-0000NN-TV for pgsql-hackers@postgresql.org; Mon, 18 May 2015 15:50:30 +0000 Received: from mfilter22-d.gandi.net (mfilter22-d.gandi.net [217.70.178.150]) by relay4-d.mail.gandi.net (Postfix) with ESMTP id 0D314172142; Mon, 18 May 2015 17:50:26 +0200 (CEST) X-Virus-Scanned: Debian amavisd-new at mfilter22-d.gandi.net Received: from relay4-d.mail.gandi.net ([217.70.183.196]) by mfilter22-d.gandi.net (mfilter22-d.gandi.net [10.0.15.180]) (amavisd-new, port 10024) with ESMTP id PIOVsS5SkaQO; Mon, 18 May 2015 17:50:24 +0200 (CEST) X-Originating-IP: 98.27.58.255 Received: from [192.168.10.146] (cpe-98-27-58-255.nc.res.rr.com [98.27.58.255]) (Authenticated sender: adsend@dunslane.net) by relay4-d.mail.gandi.net (Postfix) with ESMTPSA id 8235C17216E; Mon, 18 May 2015 17:50:18 +0200 (CEST) Message-ID: <555A0A38.40405@dunslane.net> Date: Mon, 18 May 2015 11:50:16 -0400 From: Andrew Dunstan User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.2.0 MIME-Version: 1.0 To: Jim Nasby , Josh Berkus , =?UTF-8?B?Vm9sa2VyIEHDn21hbm4=?= CC: Stephen Frost , Tom Lane , Alvaro Herrera , "pgsql-hackers@postgresql.org" Subject: Re: Disabling trust/ident authentication configure option References: <554A797B.1010101@dunslane.net> <6837.1430946793@sss.pgh.pa.us> <554A9898.9040407@agliodbs.com> <20150507150254.GA30322@tamriel.snowman.net> <20150507205749.GE30322@tamriel.snowman.net> <55596375.7070601@agliodbs.com> <555A06ED.3040609@BlueTreble.com> In-Reply-To: <555A06ED.3040609@BlueTreble.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Pg-Spam-Score: -2.6 (--) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-hackers Precedence: bulk Sender: pgsql-hackers-owner@postgresql.org On 05/18/2015 11:36 AM, Jim Nasby wrote: > On 5/17/15 10:58 PM, Josh Berkus wrote: >> The goal here was stated to preventing authentication misconfiguration >> by shortsighted admins who have superuser access and the ability to >> change pg_hba.conf. This is tantamount to giving someone a gun and >> bullets, but expecting duct tape across the cartridge slot to prevent >> them from loading or using the gun. > > The idea is to prevent *accidental* misconfiguration, not to try and > permanently lock them out. IE: make them think before allowing them to > just do something silly. Disabling auth methods at compile time seems > a very reasonable way to accomplish that. It's not more secure or more useful if it increases substantially the difficulty and disruption of recovering from misconfiguration, whether accidental or not. Disabling both trust and peer would do just that, without significantly impeding malicious users. cheers andrew -- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers