| From: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> |
|---|---|
| To: | Peter Eisentraut <peter_e(at)gmx(dot)net> |
| Cc: | pgsql-hackers(at)postgresql(dot)org, Bruce Momjian <bruce(at)momjian(dot)us>, Tomasz Ostrowski <tometzky(at)batory(dot)org(dot)pl> |
| Subject: | Re: Spoofing as the postmaster |
| Date: | 2007-12-22 18:04:47 |
| Message-ID: | 25142.1198346687@sss.pgh.pa.us |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
Peter Eisentraut <peter_e(at)gmx(dot)net> writes:
> Wouldn't SSL work over Unix-domain sockets as well? The API only deals with
> file descriptors.
Hmm ... we've always thought of SSL as being primarily comm security
and thus useless on a Unix socket, but the mutual authentication aspect
could come in handy as an answer for this type of threat. Anyone want
to try this and see if it really works or not?
Does OpenSSL have a mode where it only does mutual auth and not
encryption? The encryption would be wasted cycles in this scenario,
so being able to turn it off would be nice.
regards, tom lane
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Mike Rylander | 2007-12-22 18:51:39 | Re: Spoofing as the postmaster |
| Previous Message | Magnus Hagander | 2007-12-22 16:15:20 | Re: Spoofing as the postmaster |