Feedback-ID: i0fe9450f:Fastmail
Date: Tue, 22 Aug 2023 08:04:18 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Robert Haas <robertmhaas@gmail.com>
Cc: Stephen Frost <sfrost@snowman.net>,
	Jacob Champion <jchampion@timescale.com>,
	Shaun Thomas <shaun.thomas@enterprisedb.com>,
	pgsql-hackers@postgresql.org
Subject: Re: Logging of matching pg_hba.conf entry during auth skips trust
 auth, potential security issue
Message-ID: <ZOPtck3RRchSzQR8@paquier.xyz>
References: <CAAWbhmiP+6r0XE6pgRyD0=sRi1k4muqo-Z=eLFgLKX-6smYZmw@mail.gmail.com>
 <ZN5EVlL9ozTBJm8e@tamriel.snowman.net>
 <CAAWbhmjZ0OFvZ79i9cn7nNBHG_L5SWaBMz+NUi0qbZr4mVbjZQ@mail.gmail.com>
 <ZN5O6rndUbkZ5DWu@tamriel.snowman.net>
 <CAAWbhmjOF0fzn=zrq58DtC2EM7aMAfK3qQ+1nfttSyM0gpJCeQ@mail.gmail.com>
 <CA+TgmobN1vi-DmEsekCFz_hzAdU8-9DihYRq4Eewnw0R+Br26Q@mail.gmail.com>
 <CAOuzzgrh5_gu-YBx2pxwwuUrBtYmgD7=itTbEMQuY4V9XE86Lg@mail.gmail.com>
 <ZN6x/OCBhRvS3KmY@paquier.xyz>
 <ZOKogxFDNYwwbS27@paquier.xyz>
 <CA+TgmoYQ8_5vqEe0O4JkSx2H50sCrKZJxr7EG3JEzDJHezA8fA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="MU4q+lt7VIVUwZ4P"
Content-Disposition: inline
In-Reply-To: <CA+TgmoYQ8_5vqEe0O4JkSx2H50sCrKZJxr7EG3JEzDJHezA8fA@mail.gmail.com>
Archived-At: <https://www.postgresql.org/message-id/ZOPtck3RRchSzQR8%40paquier.xyz>
Precedence: bulk


--MU4q+lt7VIVUwZ4P
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, Aug 21, 2023 at 09:27:51AM -0400, Robert Haas wrote:
> + * No authentication identity was set; this happens e.g. when the
> + * trust method is in use.  For audit purposes, log a breadcrumb to
> + * explain where in the HBA this happened.
>=20
> Proposed rewrite: "Normally, if log_connections is set, the call to
> set_authn_id will log the connection. However, if that function is
> never called, perhaps because the trust method is in use, then we
> handle the logging here instead."

WFM.
--
Michael

--MU4q+lt7VIVUwZ4P
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmTj7XIACgkQnvQgOdby
QH0nog//aLl638nXlF6eLSbvdgjc0Dk3APpm5h0EoyuTDK80W9fzzOw1hoMwXkAv
MTzqc59v1mAISpSYp3kl3DEX1OZ9UkjV0UuQws7cNAXhdeTGeqQKaLDTclIPyRsw
aOKyBIHoCkGihrw3LzQt56uxXdjEE6jTnusCmpwwnhuXDNCwEAFhMGAeXTZ3MZ/Q
m+f88UG2tct6ONO5i3M5djy/BmmyNBskNw/UBq2wbk3oEHObNC3FUwsAFwJ7Io7j
JKMHqgG0NM/IN5+Nn/Tcl1ZSss8OiyfVdjgBS1MzN+Nhd69085Fe63HKIRWAayHG
2rqxEbfxKrcrO/eiBOS8A85koqQCx9+hbuI6VP8s/jSzuZ63S+XesowMFe3XYL1Z
z/vcCj/yIubIQ5+r8SdSwI5/7lYiLKtOL10B4rRCy4ZD9DsyvLqkSPK4HXI4LJK5
qeaRkhf45STOhB9/i0mnDscecR9deyRxkMsy0jQEorFVS8kZ11KZAkfMpFOYmNqK
g0sjIFV0RGU0rx84IHKQE2Uj6DQC7Y0gl9KN3nWwE4H94F+fUmfAMicB3wuTimYF
Sl5nt4P8ktHR7QEuLZywuEd6mGxFW5ih4y9VXiw3CyS8W1TeAZwTJchPxJeAqtD1
9ulJahv0xhGDuk6YGNAKNLsEt6FuM3lKLemQh15AX77B0L8oIC8=
=g5iJ
-----END PGP SIGNATURE-----

--MU4q+lt7VIVUwZ4P--