From: Robbie Harwood <rharwood@redhat.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
To: Stephen Frost <sfrost@snowman.net>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Alvaro Herrera <alvherre@2ndquadrant.com>
Cc: David Steele <david@pgmasters.net>
Cc: Joe Conway <mail@joeconway.com>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: Michael Paquier <michael@paquier.xyz>
Cc: Nico Williams <nico@cryptonector.com>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH v20] GSSAPI encryption support
Date: Thu, 04 Apr 2019 13:15:48 -0400
Message-ID: <jlgsguxr8sb.fsf@redhat.com> (raw)
In-Reply-To: <15827.1554394584@sss.pgh.pa.us>
References: <500b1be7-d0aa-96a2-9982-d748609faff5@joeconway.com>
<CABUevEyuNNJv=19foa=ycTfTfBUYOEwM8_Uss5OVKrwBAy+Btw@mail.gmail.com>
<20190403144332.GD6197@tamriel.snowman.net>
<7b7035e0-3691-ca63-0957-25d17dc11514@2ndquadrant.com>
<CAOuzzgrztzi+g5vfd-dtNxx+MByZcy9nMVzavYZTgvZGHx98Hg@mail.gmail.com>
<5406.1554388830@sss.pgh.pa.us>
<20190404144818.GI6197@tamriel.snowman.net>
<5945.1554389568@sss.pgh.pa.us>
<20190404150054.GJ6197@tamriel.snowman.net>
<7566.1554391003@sss.pgh.pa.us>
<20190404152439.GK6197@tamriel.snowman.net>
<8476.1554391968@sss.pgh.pa.us>
<15827.1554394584@sss.pgh.pa.us>
Tom Lane <tgl@sss.pgh.pa.us> writes:
> I wrote:
>> Stephen Frost <sfrost@snowman.net> writes:
>>> So I'm a bit surprised that it's taking 4 minutes for you. I wonder if
>>> there might be an issue related to the KDC wanting to get some amount of
>>> random data and the system you're on isn't producing random bytes very
>>> fast..?
>
>> Not sure. This is my usual development box and it also does mail, DNS,
>> etc for my household, so I'd expect it to have plenty of entropy.
>> But it's running a pretty old kernel, and old Kerberos too, so maybe
>> the explanation is in there somewhere.
>
> Same test on a laptop running Fedora 28 takes a shade under 5 seconds.
> The laptop has a somewhat better geekbench rating than my workstation,
> but certainly not 50x better. And I really doubt it's got more entropy
> sources than the workstation. Gotta be something about the kernel.
>
> Watching the test logs, I see that essentially all the time on the RHEL6
> machine is consumed by the two
>
> # Running: /usr/sbin/kdb5_util create -s -P secret0
>
> steps. Is there a case for merging the two scripts so we only have to
> do that once? Maybe not, if nobody else sees this.
I think that would be a good idea! Unfortunately I don't speak perl
well enough to do that, so I'd just copied-and-modified.
Thanks,
--Robbie
Attachments:
signature.asc (application/pgp-signature, 832B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: rharwood@redhat.com, tgl@sss.pgh.pa.us, sfrost@snowman.net, peter.eisentraut@2ndquadrant.com, alvherre@2ndquadrant.com, david@pgmasters.net, mail@joeconway.com, magnus@hagander.net, michael@paquier.xyz, nico@cryptonector.com
Subject: Re: [PATCH v20] GSSAPI encryption support
In-Reply-To: <jlgsguxr8sb.fsf@redhat.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox