From: Sergio A. Kessler <ser@perio.unlp.edu.ar>
To: Lamar Owen <lamar.owen@wgcr.org>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: pgsql-interfaces@postgreSQL.org <pgsql-interfaces@postgreSQL.org>
Subject: Re: [INTERFACES] pg_pwd
Date: Sun, 21 Nov 1999 20:53:15 -0300
Message-ID: <383885EB.8AD038FA@perio.unlp.edu.ar> (raw)
References: <23778.943151100@sss.pgh.pa.us>
<99112021424602.00940@lorc.wgcr.org>
Lamar Owen wrote:
> The RPM installation makes the directory automatically -- owned by user
> postgres, mode 755. A two byte change in the spec file and rebuilding the
> RPM's will fix this to mode 700 from the packaging end. HOWEVER, if someone
> already has the RPM's, all they need to do is run, as root, 'chmod 0700
> /var/lib/pgsql' -- much quicker than a multimegabyte download of a new RPM set
> that contains no real fixes.
maybe no real fixes ... but the current state is that we have a
security hole more bigger than the crater of gorongoro.
I agreed on doing just a chmod, but lots of people wouldn't do that,
then you have to provide a smooth migration path in the next release,
changing pgdata from 755 (created with the rpm) to 700.
> Now, if a sloppy admin goes in and changes things after the installation, that
> is their own problem.
yup, but it was not me who chmod'ed 755 /var/lib/pgsql nor
chmod'ed 666 pg_pwd, leaving all passwords in clear to all
users on the system, not me ...
--
-= Sergio A. Kessler == http://sak.org.ar =-
You can have it soon, cheap and working; choose *two*.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-interfaces@postgresql.org
Cc: ser@perio.unlp.edu.ar, lamar.owen@wgcr.org, tgl@sss.pgh.pa.us
Subject: Re: [INTERFACES] pg_pwd
In-Reply-To: <383885EB.8AD038FA@perio.unlp.edu.ar>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox