Re: [HACKERS] PAM authentication fails for local UNIX users

2007-08-20 Thread Zdenek Kotala
Andrew Dunstan wrote: Zdenek Kotala wrote: The problem what Dhanaraj tries to address is how to secure solve problem with PAM and local user. Other servers (e.g. sshd) allow to run master under root (with limited privileges) and forked process under normal user. But postgresql requires st

Re: [HACKERS] PAM authentication fails for local UNIX users

2007-08-20 Thread Jeroen T. Vermeulen
On Mon, August 20, 2007 19:52, Andrew Dunstan wrote: > I'd rather see an HBA fallback mechanism, which I suspect might overcome > most of the problems being encountered here. I implemented a form of that once, so on local connections you could do ident mapping with fallback to PAM or some other

Re: [HACKERS] PAM authentication fails for local UNIX users

2007-08-20 Thread Andrew Dunstan
Zdenek Kotala wrote: The problem what Dhanaraj tries to address is how to secure solve problem with PAM and local user. Other servers (e.g. sshd) allow to run master under root (with limited privileges) and forked process under normal user. But postgresql requires start as non-root user. I

Re: [HACKERS] PAM authentication fails for local UNIX users

2007-08-20 Thread Zdenek Kotala
Andrew Dunstan wrote: Dhanaraj M wrote: The non-root user does not have the permission to read other unix local user password. I found two solutions: 1. usermod -K defaultpriv=Basic,file_dac_read postgres - Gives privilege to read all files. This solution works. Is it the right way t

Re: [HACKERS] PAM authentication fails for local UNIX users

2007-08-20 Thread Andrew Dunstan
Dhanaraj M wrote: Hi all, http://archives.postgresql.org/pgsql-admin/2003-02/msg00301.php I also try to address the same issue.. I run postmaster as postgres user and pg_hba.conf includes the following entry: local all dhanaraj pam However, the auth