| From: | Michael Paquier <michael(at)paquier(dot)xyz> |
|---|---|
| To: | Stephen Frost <sfrost(at)snowman(dot)net> |
| Cc: | Robert Haas <robertmhaas(at)gmail(dot)com>, Jacob Champion <jchampion(at)timescale(dot)com>, Shaun Thomas <shaun(dot)thomas(at)enterprisedb(dot)com>, pgsql-hackers(at)postgresql(dot)org |
| Subject: | Re: Logging of matching pg_hba.conf entry during auth skips trust auth, potential security issue |
| Date: | 2023-08-20 23:57:55 |
| Message-ID: | ZOKogxFDNYwwbS27@paquier.xyz |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
On Fri, Aug 18, 2023 at 08:49:16AM +0900, Michael Paquier wrote:
> After sleeping on it, I think that I'd just agree with Robert's point
> to just use the same language as the message, while also agreeing with
> the patch to not set MyClientConnectionInfo.authn_id in the uaTrust
> case, only logging something under log_connections.
>
> + * No authentication was actually performed; this happens e.g. when the
> + * trust method is in use.
>
> This comment should be reworded a bit, say "No authentication identity
> was set; blah ..".
Attached is a v3 to do these two things, with adjustments for two SSL
tests. Any objections about it?
(Note: no backpatch)
--
Michael
| Attachment | Content-Type | Size |
|---|---|---|
| v3-0001-log_connections-add-entries-for-trust-connections.patch | text/x-diff | 3.4 KB |
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Peter Smith | 2023-08-21 00:04:05 | Re: Adding a LogicalRepWorker type field |
| Previous Message | Peter Geoghegan | 2023-08-20 22:42:39 | Re: POC, WIP: OR-clause support for indexes |