pg.ddx.io pgsql-interfaces@postgresql.org mailing list archive
help / color / mirror / Atom feedRe: ODBC problem - crypt..
5+ messages / 3 participants
[nested] [flat]
* Re: ODBC problem - crypt..
@ 2000-10-09 21:39 Cedar Cox <cedarc@visionforisrael.com>
0 siblings, 1 reply; 5+ messages in thread
From: Cedar Cox @ 2000-10-09 21:39 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Peter Eisentraut <peter_e@gmx.net>; Tom Samplonius <tom@sdf.com>; George P. Esperanza <george@calamba.laguna.net>; pgsql-interfaces
On Mon, 9 Oct 2000, Tom Lane wrote:
..
> We have talked about adding a higher-security login protocol --- you can
> find past threads about this in the pghackers archive. IIRC a fairly
> complete design was worked out, but no one's got round to implementing
> it yet. There might still have been some unresolved objections, too.
>
> regards, tom lane
Perhaps I didn't make my point clear: The only point of a password is to
protect something. If that something is transmitted in the clear, then
from a hackers point of view there's almost no point in having a password.
Of course this only applies to fetching data.. updates are a different
story.
So. If working with sensitive data, shouldn't the data be encrypted as
well, not just the login sequence? Is ssh a good way to go (assuming you
have an account on the PG machine), and is what I proposed possible?
-Cedar
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: ODBC problem - crypt..
@ 2000-10-09 22:18 Tom Lane <tgl@sss.pgh.pa.us>
parent: Cedar Cox <cedarc@visionforisrael.com>
0 siblings, 1 reply; 5+ messages in thread
From: Tom Lane @ 2000-10-09 22:18 UTC (permalink / raw)
To: Cedar Cox <cedarc@visionforisrael.com>; +Cc: pgsql-interfaces
Cedar Cox <cedarc@visionforisrael.com> writes:
> So. If working with sensitive data, shouldn't the data be encrypted as
> well, not just the login sequence?
Yup; see SSL.
IIRC this was one of the reasons why a sniff-proof password security
protocol didn't seem like a critical issue.
regards, tom lane
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: ODBC problem - crypt..
@ 2000-10-10 12:39 Cedar Cox <cedarc@visionforisrael.com>
parent: Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 5+ messages in thread
From: Cedar Cox @ 2000-10-10 12:39 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: pgsql-interfaces
On Mon, 9 Oct 2000, Tom Lane wrote:
>
> Yup; see SSL.
>
> IIRC this was one of the reasons why a sniff-proof password security
> protocol didn't seem like a critical issue.
Ooooh-K. Sounds good, but I know next to nothing about SSL. Where is a
good place to start? Had a look at the PG source, from the looks of it, a
SSL link is established before any other data is sent (including
username/password), correct? Are there any special libraries required for
compiling PG with SSL support? Also, what about use of SSL inside/outside
the US?
Now for the big question: Does the ODBC driver support SSL connections?
-Cedar
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: ODBC problem - crypt..
@ 2000-10-10 15:28 Tom Lane <tgl@sss.pgh.pa.us>
parent: Cedar Cox <cedarc@visionforisrael.com>
0 siblings, 1 reply; 5+ messages in thread
From: Tom Lane @ 2000-10-10 15:28 UTC (permalink / raw)
To: Cedar Cox <cedarc@visionforisrael.com>; +Cc: pgsql-interfaces
Cedar Cox <cedarc@visionforisrael.com> writes:
> SSL link is established before any other data is sent (including
> username/password), correct?
Right. BTW, I believe the SSL support is actually broken in 7.0.* :-(
(the lack of complaints doesn't say much for the number of people
worried about comsec for PG). It's allegedly fixed in current sources
but I haven't tried it. I'd suggest experimenting with a current
snapshot.
> Are there any special libraries required for
> compiling PG with SSL support? Also, what about use of SSL inside/outside
> the US?
You need SSL which is a separate package. Beyond that I haven't a clue;
you'll have to go look for info about SSL.
> Now for the big question: Does the ODBC driver support SSL connections?
[... grep ...] Apparently not. libpq (and therefore anything built
atop libpq) does, but ODBC doesn't use libpq. ODBC needs some other
updates too --- for instance, it still thinks there's a limit on query
string length.
Right now I don't think anyone is actively maintaining ODBC, but it
badly needs someone to care for it. Any volunteers out there?
regards, tom lane
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: ODBC problem - crypt..
@ 2000-10-10 18:26 Jamie Walker <jamie@sagaxis.co.uk>
parent: Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 0 replies; 5+ messages in thread
From: Jamie Walker @ 2000-10-10 18:26 UTC (permalink / raw)
To: pgsql-interfaces
In article <19102.971191714@sss.pgh.pa.us>, Tom Lane <tgl@sss.pgh.pa.us>
writes
>Right now I don't think anyone is actively maintaining ODBC, but it
>badly needs someone to care for it. Any volunteers out there?
Does anyone know if it's possible to compile it using freely available
tools? I'm thinking the win32 cross-compiler, mingw32 or something. I do
have an old copy of VisualC++ (4.2), but try to avoid using it. Do I
need and ODBC driver SDK or something?
I don't know enough about ODBC to maintain the driver properly, but if I
can get it to build in a reasonable way, I'll take all the available
patches and make binaries available...
--
Jamie Walker "While there are no known bugs in it, it might
jamie@sagaxis.co.uk destroy your filesystems, eat your data and
http://www.sagaxis.co.uk/ start World War III. You have been warned."
^ permalink raw reply [nested|flat] 5+ messages in thread
end of thread, other threads:[~2000-10-10 18:26 UTC | newest]
Thread overview: 5+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2000-10-09 21:39 Re: ODBC problem - crypt.. Cedar Cox <cedarc@visionforisrael.com>
2000-10-09 22:18 ` Tom Lane <tgl@sss.pgh.pa.us>
2000-10-10 12:39 ` Cedar Cox <cedarc@visionforisrael.com>
2000-10-10 15:28 ` Tom Lane <tgl@sss.pgh.pa.us>
2000-10-10 18:26 ` Jamie Walker <jamie@sagaxis.co.uk>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox