| From: | Martijn van Oosterhout <kleptog(at)svana(dot)org> |
|---|---|
| To: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> |
| Cc: | Marko Kreen <markokr(at)gmail(dot)com>, Peter Eisentraut <peter_e(at)gmx(dot)net>, pgsql-hackers(at)postgresql(dot)org, Bruce Momjian <bruce(at)momjian(dot)us>, Tomasz Ostrowski <tometzky(at)batory(dot)org(dot)pl> |
| Subject: | Re: Spoofing as the postmaster |
| Date: | 2007-12-23 13:55:37 |
| Message-ID: | 20071223135537.GC10545@svana.org |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
On Sat, Dec 22, 2007 at 02:21:42PM -0500, Tom Lane wrote:
> No, we shouldn't, and if I had any authority over them I would make
> Debian stop doing that. It amounts to a unilateral distro-specific
> change in the protocol, and I think it makes things *less* secure,
> because any clients who are expecting the socket to be in /tmp will be
> easy pickings for a spoofer. Debian cannot hope to prevent that
> scenario, because there are non-libpq-based client implementations.
Well, it's worked for many years and a little late to change now. It's
arguably safer, since only postmasters owned by "postgres" can create a
socket in that directory, any client attempting to connect to a server
using that directory knows it's connecting to a server owned by
'postgres'.
I can't think of any non-libpq clients which support Unix domain
sockets?
Have a nice day,
--
Martijn van Oosterhout <kleptog(at)svana(dot)org> http://svana.org/kleptog/
> Those who make peaceful revolution impossible will make violent revolution inevitable.
> -- John F Kennedy
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Magnus Hagander | 2007-12-23 14:07:44 | Re: Spoofing as the postmaster |
| Previous Message | Peter Eisentraut | 2007-12-23 13:35:01 | Re: Spoofing as the postmaster |