Message-ID: <4870001C.6060402@dunslane.net>
Date: Sat, 05 Jul 2008 19:13:32 -0400
From: Andrew Dunstan <andrew@dunslane.net>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US;
	rv:1.8.0.12) Gecko/20071019 Fedora/1.0.9-3.fc6 pango-text
	SeaMonkey/1.0.9
MIME-Version: 1.0
To: Robert Treat <xzilla@users.sourceforge.net>
CC: pgsql-hackers@postgresql.org, Tom Lane <tgl@sss.pgh.pa.us>,
	Garick Hamlin <ghamlin@isc.upenn.edu>, pgsql-patches@postgresql.org
Subject: Re: [PATCHES] Solaris ident authentication using unix domain sockets
References: <20080703165936.E80B312A5FFF@mx2.hub.org>
	<20080703173628.GA1697@isc.upenn.edu>
	<5091.1215108082@sss.pgh.pa.us>
	<200807051805.57381.xzilla@users.sourceforge.net>
In-Reply-To: <200807051805.57381.xzilla@users.sourceforge.net>
Content-Type: text/plain; charset=ISO-8859-15; format=flowed
Content-Transfer-Encoding: 7bit


Robert Treat wrote:
> On Thursday 03 July 2008 14:01:22 Tom Lane wrote:
>   
>> Garick Hamlin <ghamlin@isc.upenn.edu> writes:
>>     
>>> 	I have a patch that I have been using to support postgresql's
>>> notion of ident authentication when using unix domain sockets on
>>> Solaris.  This patch basically just adds support for using
>>> getupeercred() on Solaris so unix sockets and ident auth works just
>>> like it does on Linux and elsewhere.
>>>       
>> Cool.
>>
>>     
>
> Hmm... I've always been told that Solaris didn't support this because the 
> Solaris developers feel that IDENT is inherently insecure. If that is more 
> than just a philosphical opinion, I wonder if there should be additional 
> hurdles in place to enable this on that platform. Note that isn't an 
> objection from me, though I'm curious if any of the Sun guys want to chime in 
> on this. 
>
>   


We don't actually use the Ident protocol for Unix sockets on any 
platform. AIUI, this patch just implements what we do on platforms like 
Linux or *BSD.

cheers

andrew