Message-ID: <4873BC28.3070507@phlo.org>
Date: Tue, 08 Jul 2008 21:12:40 +0200
From: "Florian G. Pflug" <fgp@phlo.org>
User-Agent: Thunderbird 2.0.0.14 (Macintosh/20080421)
MIME-Version: 1.0
To: Josh Berkus <josh@agliodbs.com>
CC: pgsql-hackers@postgresql.org, Tom Lane <tgl@sss.pgh.pa.us>,
	Andrew Dunstan <andrew@dunslane.net>,
	Robert Treat <xzilla@users.sourceforge.net>,
	Garick Hamlin <ghamlin@isc.upenn.edu>, pgsql-patches@postgresql.org
Subject: Re: [PATCHES] Solaris ident authentication using unix domain sockets
References: <20080703165936.E80B312A5FFF@mx2.hub.org>
	<4870001C.6060402@dunslane.net> <23040.1215319905@sss.pgh.pa.us>
	<200807080935.33186.josh@agliodbs.com>
In-Reply-To: <200807080935.33186.josh@agliodbs.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

Josh Berkus wrote:
> Tom,
> 
>> Indeed.  If the Solaris folk feel that getupeercred() is insecure,
>>  they had better explain why their kernel is that broken.  This is
>>  entirely unrelated to the known shortcomings of the "ident" IP 
>> protocol.
> 
> The Solaris security & kernel folks do, actually.  However, there's 
> no question that TRUST is inherently insecure, and that's what people
>  are going to use if they can't get IDENT to work.

I'd be *very* interested in how they come to that assessment. I'd have
thought that the only alternative to getpeereid/getupeercred is
password-based or certificate-based authenticated - which seem *less*
secure because a) they also rely on the client having the correct uid
or gid (to read the password/private key), plus b) the risk of the
password/private key getting into the wrong hands.

How is that sort of authenticated handled by services shipping with solaris?

regards, Florian Pflug, hoping to be enlightened beyond his limited
posix-ish view of the world...