From: Robbie Harwood <rharwood@redhat.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Michael Paquier <michael.paquier@gmail.com>
Cc: PostgreSQL mailing lists <pgsql-hackers@postgresql.org>
Cc: Stephen Frost <sfrost@snowman.net>
Subject: Re: [PATCH v12] GSSAPI encryption support
Date: Tue, 26 Jul 2016 12:24:39 -0400
Message-ID: <jlgy44oe5a0.fsf@thriss.redhat.com> (raw)
In-Reply-To: <18337.1469546948@sss.pgh.pa.us>
References: <jlg1tgq1ktm.fsf@thriss.redhat.com>
<jlgy48ssyvl.fsf@thriss.redhat.com>
<20160406112105.GG10850@tamriel.snowman.net>
<jlg1t6isftk.fsf@thriss.redhat.com>
<1530.1459977031@sss.pgh.pa.us>
<jlgy48qqt86.fsf@thriss.redhat.com>
<5486.1459984857@sss.pgh.pa.us>
<CAB7nPqRPK1f4oAStwsy_Ty_Cjjo8U50HF0bRZi86my7va4nVdg@mail.gmail.com>
<jlgk2hq3uvr.fsf@thriss.redhat.com>
<jlg7fc91lko.fsf@thriss.redhat.com>
<CAB7nPqSmq1tuVGoVQXVb86y9SoaM-wcMDxHD1of9dGc54QYNSQ@mail.gmail.com>
<jlg7fc8fmq7.fsf@thriss.redhat.com>
<18337.1469546948@sss.pgh.pa.us>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
Tom Lane <tgl@sss.pgh.pa.us> writes:
> Robbie Harwood <rharwood@redhat.com> writes:
>> So there's a connection setting `sslmode` that we'll want something
>> similar to here (`gssapimode` or so). `sslmode` has six settings, but I
>> think we only need three for GSSAPI: "disable", "allow", and "prefer"
>> (which presumably would be the default).
>
> FWIW, there is quite a bit of unhappiness around sslmode=prefer, see
> for example this thread:
> https://www.postgresql.org/message-id/flat/2A5EFBDC-41C6-42A8-8B6D-E69DA60E9962%40eggerapps.at
>
> I do not know if we can come up with a better answer, but I'd caution
> you against thinking that that's a problem-free model to emulate.
Understood. We have the slight simplification for GSSAPI of having
mutual authentication always (i.e., no need to worry about
unauthenticated-but-encrypted connections).
My personal view is that we want to try for as much security as we can
without breaking anything [0]. If a user knows that they want a specific
security, they can set "require"; if they don't want it, they can set
"disable". Setting "require" as the default breaks one class of users;
setting "disable" another. And I don't think we can punt the problem to
the user and make it a mandatory parameter, either.
I'm absolutely open to suggestions for how we could do better here,
especially since we're adding support for something new, but having read
the thread you mention I don't immediately see a superior design.
0: For what it's worth, I also don't agree with the assertion that
having the ability to fallback to plaintext from tampering makes the
attempt at encryption useless; rather, it still foils a passive
adversary, even if it doesn't do anything against an active one.
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: rharwood@redhat.com, tgl@sss.pgh.pa.us, michael.paquier@gmail.com, sfrost@snowman.net
Subject: Re: [PATCH v12] GSSAPI encryption support
In-Reply-To: <jlgy44oe5a0.fsf@thriss.redhat.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox