Re: [HACKERS] RADIUS authentication

2010-01-25 Thread Magnus Hagander
2010/1/25 KaiGai Kohei kai...@ak.jp.nec.com: (2010/01/24 23:29), Magnus Hagander wrote: There is one more option here - use OpenSSL if available. It has functions for secure random number generations (http://www.openssl.org/docs/crypto/RAND_bytes.html).  That seems easy enough when OpenSSL is

Re: [HACKERS] RADIUS authentication

2010-01-25 Thread KaiGai Kohei
(2010/01/26 6:30), Magnus Hagander wrote: 2010/1/25 KaiGai Koheikai...@ak.jp.nec.com: (2010/01/24 23:29), Magnus Hagander wrote: There is one more option here - use OpenSSL if available. It has functions for secure random number generations

Re: [HACKERS] RADIUS authentication

2010-01-24 Thread Magnus Hagander
2010/1/20 KaiGai Kohei kai...@ak.jp.nec.com: (2010/01/20 0:19), Magnus Hagander wrote: * I think this comment is right.   +   for (i = 0; i  RADIUS_VECTOR_LENGTH; i++)   +       /* XXX: Generate a more secure random string? */   +       packet-vector[i] = random() % 255;   The random seed

Re: [HACKERS] RADIUS authentication

2010-01-24 Thread Magnus Hagander
2010/1/24 Magnus Hagander mag...@hagander.net: 2010/1/20 KaiGai Kohei kai...@ak.jp.nec.com: As Tom pointed out, it is fundamentally same. The matter is this random() invocation is the first time after initialization of random seed by srandom(). It means an external observer can estimate the

Re: [HACKERS] RADIUS authentication

2010-01-24 Thread KaiGai Kohei
(2010/01/24 23:29), Magnus Hagander wrote: 2010/1/20 KaiGai Koheikai...@ak.jp.nec.com: (2010/01/20 0:19), Magnus Hagander wrote: * I think this comment is right. + for (i = 0; iRADIUS_VECTOR_LENGTH; i++) + /* XXX: Generate a more secure random string? */ +

Re: [HACKERS] RADIUS authentication

2010-01-19 Thread Magnus Hagander
2010/1/18 KaiGai Kohei kai...@ak.jp.nec.com: (2010/01/10 22:25), Magnus Hagander wrote: The attached patch implements RADIUS authentication (RFC2865-compatible). The main usecase for me in this is the ability to use (token based) one-time-password systems easily with PostgreSQL. These systems

Re: [HACKERS] RADIUS authentication

2010-01-19 Thread Tom Lane
Magnus Hagander mag...@hagander.net writes: 2010/1/18 KaiGai Kohei kai...@ak.jp.nec.com:  The random seed is initialized at BackendRun() with MyProcPid and  the time of backend process launched.  Then, PostgresMain() - InitPostgres() - PerformAuthentication()  will be called, and this

Re: [HACKERS] RADIUS authentication

2010-01-19 Thread KaiGai Kohei
(2010/01/20 0:19), Magnus Hagander wrote: 2010/1/18 KaiGai Koheikai...@ak.jp.nec.com: (2010/01/10 22:25), Magnus Hagander wrote: The attached patch implements RADIUS authentication (RFC2865-compatible). The main usecase for me in this is the ability to use (token based) one-time-password

Re: [HACKERS] RADIUS authentication

2010-01-18 Thread KaiGai Kohei
(2010/01/10 22:25), Magnus Hagander wrote: The attached patch implements RADIUS authentication (RFC2865-compatible). The main usecase for me in this is the ability to use (token based) one-time-password systems easily with PostgreSQL. These systems almost always support RADIUS, and the

[HACKERS] RADIUS authentication

2010-01-10 Thread Magnus Hagander
The attached patch implements RADIUS authentication (RFC2865-compatible). The main usecase for me in this is the ability to use (token based) one-time-password systems easily with PostgreSQL. These systems almost always support RADIUS, and the implementation is fairly simple. RADIUS can of course

Re: [HACKERS] RADIUS authentication

2010-01-10 Thread Peter Eisentraut
On sön, 2010-01-10 at 14:25 +0100, Magnus Hagander wrote: The attached patch implements RADIUS authentication (RFC2865-compatible). The main usecase for me in this is the ability to use (token based) one-time-password systems easily with PostgreSQL. These systems almost always support

Re: [HACKERS] RADIUS authentication

2010-01-10 Thread Magnus Hagander
On Sun, Jan 10, 2010 at 18:55, Peter Eisentraut pete...@gmx.net wrote: On sön, 2010-01-10 at 14:25 +0100, Magnus Hagander wrote: The attached patch implements RADIUS authentication (RFC2865-compatible). The main usecase for me in this is the ability to use (token based) one-time-password

Re: [HACKERS] RADIUS authentication

2010-01-10 Thread Stephen Frost
Magnus, * Magnus Hagander (mag...@hagander.net) wrote: The attached patch implements RADIUS authentication (RFC2865-compatible). Great! We have a few environments which use RADIUS auth, nice that PG might be able to use that auth method in the future. I'm not a fan of having the shared