* Magnus Hagander ([EMAIL PROTECTED]) wrote:
> > > The way our Kerberos implementation is done, it does *not* validate
> > > the server, just the client. If you want server
> > verification, you must
> > > use a combination of both Kerberos and SSL.
> >
> > Eh? We use mutual authentication in
> > The way our Kerberos implementation is done, it does *not* validate
> > the server, just the client. If you want server
> verification, you must
> > use a combination of both Kerberos and SSL.
>
> Eh? We use mutual authentication in Kerberos...
We do? That's good then :-) I was told by so
* Magnus Hagander ([EMAIL PROTECTED]) wrote:
> The way our Kerberos implementation is done, it does *not* validate the
> server, just the client. If you want server verification, you must use a
> combination of both Kerberos and SSL.
Eh? We use mutual authentication in Kerberos...
Stephe
* Tom Lane ([EMAIL PROTECTED]) wrote:
> Martijn van Oosterhout writes:
> > These no real way around this. The only real option would be moving to
> > a home directory but that would require knowing the username the server
> > is running under...
>
> And the problem would still exist, with even le
* Magnus Hagander:
> But no, it wouldn't be bad if there was a way to specify exactly which
> cert is used. Or at least validate the common name of it agains the
> hostname of the server.
SSH-like "leap of faith" authentication would be even better. Store
the certificate on the first connection
> > If you stick a root certificate (root.crt in ~/.postgresql)
> for it to
> > validate against, it will be validated against that root.
> I'm not sure
> > if it validates the common name of the cert though - that
> would be an
> > issue if you're using a global CA. If you're using a local
* Martijn van Oosterhout:
> Well, I guess it's an issue. At least it's not suceptable to the
> standard symlink attacks. There is in general no way of knowing if the
> server you are connecting to is what you think it is (except via SSL
> maybe?).
For local (i.e. UNIX domain socket) connections,
"Magnus Hagander" <[EMAIL PROTECTED]> writes:
> If you stick a root certificate (root.crt in ~/.postgresql) for it to
> validate against, it will be validated against that root. I'm not sure
> if it validates the common name of the cert though - that would be an
> issue if you're using a global CA.
> I'm not sure whether our current SSL support does a good job of this
> --- I think it only tries to check whether the server
> presents a valid certificate, not which cert it is. Possibly
> Kerberos does more, but I dunno a thing about that...
If you stick a root certificate (root.crt in ~/.p
Martijn van Oosterhout writes:
> These no real way around this. The only real option would be moving to
> a home directory but that would require knowing the username the server
> is running under...
And the problem would still exist, with even less chance of solution,
for TCP connections which a
On Sat, Feb 11, 2006 at 03:04:00PM +0100, Florian Weimer wrote:
> * Tom Lane:
>
> > Actually, it's "because it's certain to be there and be accessible to
> > unprivileged users".
>
> Isn't this a bit problematic because any local user can impersonate a
> PostgreSQL backend which has been shut dow
* Tom Lane:
> Actually, it's "because it's certain to be there and be accessible to
> unprivileged users".
Isn't this a bit problematic because any local user can impersonate a
PostgreSQL backend which has been shut down?
---(end of broadcast)---
T
On 2/9/06, Tom Lane <[EMAIL PROTECTED]> wrote:
> Andrew Dunstan <[EMAIL PROTECTED]> writes:
> > Maybe this should be a configure flag, just like the port number is.
>
> It is ... that isn't the issue, the problem is exactly that Debian
> chooses to exercise the option to make their installations di
Martijn van Oosterhout writes:
> FWIW, I prefer the Debian location. AFAICS the only rationale for
> putting it in /tmp is "because it's always been there".
Actually, it's "because it's certain to be there and be accessible to
unprivileged users". If we tried to change to something like
/var/pos
On Thu, Feb 09, 2006 at 03:16:29PM -0500, Tom Lane wrote:
> Andrew Dunstan <[EMAIL PROTECTED]> writes:
> > Maybe this should be a configure flag, just like the port number is.
>
> It is ... that isn't the issue, the problem is exactly that Debian
> chooses to exercise the option to make their inst
Andrew Dunstan <[EMAIL PROTECTED]> writes:
> Maybe this should be a configure flag, just like the port number is.
It is ... that isn't the issue, the problem is exactly that Debian
chooses to exercise the option to make their installations different
from everyone else's.
r
Alvaro Herrera wrote:
Stephen Frost wrote:
* Alvaro Herrera ([EMAIL PROTECTED]) wrote:
The only thing that I hate is that libpq defaults to searching the
local socket in /var/postgresql/ or thereabouts. It really drives me
crazy and I've banned the libpq packages from my system.
Stephen Frost wrote:
> * Alvaro Herrera ([EMAIL PROTECTED]) wrote:
> > Stephen Frost wrote:
> > > Oh, pah, I'm there already, as 'Snow-Man' and I've heard all about it.
> > > Sorry that Debian/stable releases havn't been coming out as frequently
> > > as they really should have been. We're working
* Alvaro Herrera ([EMAIL PROTECTED]) wrote:
> Stephen Frost wrote:
> > Oh, pah, I'm there already, as 'Snow-Man' and I've heard all about it.
> > Sorry that Debian/stable releases havn't been coming out as frequently
> > as they really should have been. We're working on that, honest!
>
> The only
Stephen Frost wrote:
> Oh, pah, I'm there already, as 'Snow-Man' and I've heard all about it.
> Sorry that Debian/stable releases havn't been coming out as frequently
> as they really should have been. We're working on that, honest!
The only thing that I hate is that libpq defaults to searching
Alexander Schreiber wrote:
At least two of the distributions I use
regularly (Gentoo and Debian) have the habit of adding a load of patches
during package build. And not all of those go back to the upstream, to
put it mildly ...
And they are not always sensible. A while back the Gentoo pa
Devrim GUNDUZ <[EMAIL PROTECTED]> wrote:
> Hi,
>
> On Wed, 2006-02-08 at 11:28 -0500, Stephen Frost wrote:
>
>> I'd really like to see the multiple DB connections with different
>> Kerberos credentials go in to 8.1.3. It solved the problem we were
>> having authenticating to PostgreSQL using Kerbe
Kris Jurka wrote:
>
>
> On Wed, 8 Feb 2006, Tom Lane wrote:
>
> > The core committee has agreed that it's about time for a new set of
> > update releases (8.1.3, 8.0.7, etc). Barring surprises, we'll wrap
> > Sunday evening with expectation of general announcement Tuesday.
> > Any pending patch
* Tom Lane ([EMAIL PROTECTED]) wrote:
> Martijn van Oosterhout writes:
> > On Wed, Feb 08, 2006 at 06:36:10PM +0200, Devrim GUNDUZ wrote:
> >> So Debian has a patch that is not in 8.1.2? I can't believe that they
> >> are doing that -- personally I'm against to add any patch into binaries
> >> tha
* Christopher Kings-Lynne ([EMAIL PROTECTED]) wrote:
> >>[OT]
> >>So Debian has a patch that is not in 8.1.2? I can't believe that they
> >>are doing that -- personally I'm against to add any patch into binaries
> >>that is not in the core.
> >>[/OT]
> >
> >And it's days like these that make me hap
Devrim GUNDUZ wrote:
So Debian has a patch that is not in 8.1.2? I can't believe that they
are doing that -- personally I'm against to add any patch into binaries
that is not in the core.
I think the other important thing to consider is that this patch went
into debian's unstable branch, not
Martijn van Oosterhout writes:
> On Wed, Feb 08, 2006 at 06:36:10PM +0200, Devrim GUNDUZ wrote:
>> So Debian has a patch that is not in 8.1.2? I can't believe that they
>> are doing that -- personally I'm against to add any patch into binaries
>> that is not in the core.
> I consider it a form of
[OT]
So Debian has a patch that is not in 8.1.2? I can't believe that they
are doing that -- personally I'm against to add any patch into binaries
that is not in the core.
[/OT]
And it's days like these that make me happy to be running Debian. My
thanks go to Martin for his excellent work.
He
On Wed, Feb 08, 2006 at 06:36:10PM +0200, Devrim GUNDUZ wrote:
> On Wed, 2006-02-08 at 11:28 -0500, Stephen Frost wrote:
>
> > I'd really like to see the multiple DB connections with different
> > Kerberos credentials go in to 8.1.3. It solved the problem we were
> > having authenticating to Post
* Joshua D. Drake ([EMAIL PROTECTED]) wrote:
>
> >[OT]
> >So Debian has a patch that is not in 8.1.2? I can't believe that they
> >are doing that -- personally I'm against to add any patch into binaries
> >that is not in the core.
> >[/OT]
> >
> This is not a Debian thing. Lots of distributions do
On Wed, 8 Feb 2006, Tom Lane wrote:
The core committee has agreed that it's about time for a new set of
update releases (8.1.3, 8.0.7, etc). Barring surprises, we'll wrap
Sunday evening with expectation of general announcement Tuesday.
Any pending patches out there for the back branches?
I
[OT]
So Debian has a patch that is not in 8.1.2? I can't believe that they
are doing that -- personally I'm against to add any patch into binaries
that is not in the core.
[/OT]
This is not a Debian thing. Lots of distributions do it. I wouldn't be
surprised
if RedHat did it as well.
Josh
> The core committee has agreed that it's about time for a new
> set of update releases (8.1.3, 8.0.7, etc). Barring
> surprises, we'll wrap Sunday evening with expectation of
> general announcement Tuesday.
> Any pending patches out there for the back branches?
I'd like to see the bugfix part
* Devrim GUNDUZ ([EMAIL PROTECTED]) wrote:
> [OT]
> So Debian has a patch that is not in 8.1.2? I can't believe that they
> are doing that -- personally I'm against to add any patch into binaries
> that is not in the core.
> [/OT]
And it's days like these that make me happy to be running Debian.
* Tom Lane ([EMAIL PROTECTED]) wrote:
> Stephen Frost <[EMAIL PROTECTED]> writes:
> > * Tom Lane ([EMAIL PROTECTED]) wrote:
> >> Any pending patches out there for the back branches?
>
> > I'd really like to see the multiple DB connections with different
> > Kerberos credentials go in to 8.1.3.
>
Stephen Frost <[EMAIL PROTECTED]> writes:
> * Tom Lane ([EMAIL PROTECTED]) wrote:
>> Any pending patches out there for the back branches?
> I'd really like to see the multiple DB connections with different
> Kerberos credentials go in to 8.1.3.
That's a new feature, not a bug fix. I'd be against
* Devrim GUNDUZ ([EMAIL PROTECTED]) wrote:
> On Wed, 2006-02-08 at 11:28 -0500, Stephen Frost wrote:
> > I'd really like to see the multiple DB connections with different
> > Kerberos credentials go in to 8.1.3. It solved the problem we were
> > having authenticating to PostgreSQL using Kerberos f
Hi,
On Wed, 2006-02-08 at 11:28 -0500, Stephen Frost wrote:
> I'd really like to see the multiple DB connections with different
> Kerberos credentials go in to 8.1.3. It solved the problem we were
> having authenticating to PostgreSQL using Kerberos from Apache. We were
> also able to get phppg
* Tom Lane ([EMAIL PROTECTED]) wrote:
> The core committee has agreed that it's about time for a new set of
> update releases (8.1.3, 8.0.7, etc). Barring surprises, we'll wrap
> Sunday evening with expectation of general announcement Tuesday.
> Any pending patches out there for the back branches?
The core committee has agreed that it's about time for a new set of
update releases (8.1.3, 8.0.7, etc). Barring surprises, we'll wrap
Sunday evening with expectation of general announcement Tuesday.
Any pending patches out there for the back branches?
regards, tom lane
-
40 matches
Mail list logo
