From: Robbie Harwood <rharwood@redhat.com>
To: Craig Ringer <craig@2ndquadrant.com>
Cc: PostgreSQL mailing lists <pgsql-hackers@postgresql.org>
Cc: Andres Freund <andres@anarazel.de>
Cc: Michael Paquier <michael.paquier@gmail.com>
Subject: Re: [PATCH v3] GSSAPI encryption support
Date: Thu, 15 Oct 2015 13:07:51 -0400
Message-ID: <jlg1tcw6owo.fsf@thriss.redhat.com> (raw)
In-Reply-To: <CAMsr+YE-WaD4kV4vYe0WxQhgD=hJ-EHd7oJ3=ZUF614t1HMPMA@mail.gmail.com>
References: <jlg1tgq1ktm.fsf@thriss.redhat.com>
<jlgvbaao0sr.fsf@thriss.redhat.com>
<CAMsr+YE-WaD4kV4vYe0WxQhgD=hJ-EHd7oJ3=ZUF614t1HMPMA@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
Craig Ringer <craig@2ndquadrant.com> writes:
> On 14 October 2015 at 06:34, Robbie Harwood <rharwood@redhat.com> wrote:
>> Alright, here's v3. As requested, it's one patch now.
>
> I hate to ask, but have you looked at how this interacts with Windows?
>
> We support Windows SSPI (on a domain-member host) authenticating to a
> PostgreSQL server using gssapi with spnego.
>
> We also support a PostgreSQL client on *nix authenticating using
> gssapi with spnego to a PostgreSQL server that's requesting sspi mode.
>
> The relevant code is all a bit tangled, since there's support in there
> for using Kerberos libraries on Windows instead of SSPI too. I doubt
> anybody uses that last one, tests it, or cares about it, though, given
> the painful hoop-jumping, registry key permission changes, etc
> required to make it work.
>
> For bonus fun, RC4, DES, AES128 or AES256 are available/used for
> Kerberos encryption on Windows. See
> http://blogs.msdn.com/b/openspecification/archive/2011/05/31/windows-configurations-for-kerberos-sup...
> . Though given that Win7 defaults to AES256 it's probably reasonable
> to simply not care about anything else.
The short - and probably most important - answer is that no, I haven't
tested it, and it would be difficult for me to do so quickly.
In more depth:
Looking at
http://www.postgresql.org/docs/9.4/static/protocol-message-formats.html
suggests that SSPI follows a separate codepath from the GSS code;
certainly it's a different auth request, which means it shouldn't
trigger the encryption path.
There is no reason that using GSSAPI from, e.g., MIT Kerberos for
Windows, should not work here. Even more broadly than that, GSSAPI is a
RFC-standardized protocol with rigorously tested interop etc. etc.,
though whether anyone outside of MIT cares about MIT Kerberos for
Windows I have no idea. As for encryption types, MIT out-of-the-box
supports aes256 + aes128 (in several variants), rc4-hmac and friends,
camellia in several variants, and des3-cbc-sha1. A much wider selection
is available on setting the appropriately named "allow_weak_crypto" in
krb5.conf, though I would hope that would not be needed.
I think the important takeaway here is that I haven't actually changed
how *authentication* works; these changes only affect GSSAPI
post-authentication add encryption functions as defined by that
specification. So if the authentication was working before, and the
GSSAPI implementation is following RFC, I would hope that this would
work still.
Thanks,
--Robbie
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: rharwood@redhat.com, craig@2ndquadrant.com, andres@anarazel.de, michael.paquier@gmail.com
Subject: Re: [PATCH v3] GSSAPI encryption support
In-Reply-To: <jlg1tcw6owo.fsf@thriss.redhat.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox