From: Tom Lane <tgl@sss.pgh.pa.us>
To: Fernando Grijalba <jfercan@yahoo.com>
Cc: pgsql-interfaces@postgresql.org
Subject: Re: Reset expired password from .NET
Date: Tue, 30 May 2006 19:02:11 -0400
Message-ID: <4868.1149030131@sss.pgh.pa.us> (raw)
In-Reply-To: <20060530204828.59520.qmail@web88203.mail.re2.yahoo.com>
References: <20060530204828.59520.qmail@web88203.mail.re2.yahoo.com>
Fernando Grijalba <jfercan@yahoo.com> writes:
> I just realized that Postgresql does not differentiate between an invalid username/password or an expired password when it gives you the error message.
That's intentional. Per the comments in auth.c:
* Tell the user the authentication failed, but not (much about) why.
*
* There is a tradeoff here between security concerns and making life
* unnecessarily difficult for legitimate users. We would not, for example,
* want to report the password we were expecting to receive...
* But it seems useful to report the username and authorization method
* in use, and these are items that must be presumed known to an attacker
* anyway.
* Note that many sorts of failure report additional information in the
* postmaster log, which we hope is only readable by good guys.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-interfaces@postgresql.org
Cc: tgl@sss.pgh.pa.us, jfercan@yahoo.com
Subject: Re: Reset expired password from .NET
In-Reply-To: <4868.1149030131@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox