Skip site navigation (1) Skip section navigation (2)

Re: Spoofing as the postmaster

From: Martijn van Oosterhout <kleptog(at)svana(dot)org>
To: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
Cc: Marko Kreen <markokr(at)gmail(dot)com>, Peter Eisentraut <peter_e(at)gmx(dot)net>,pgsql-hackers(at)postgresql(dot)org, Bruce Momjian <bruce(at)momjian(dot)us>,Tomasz Ostrowski <tometzky(at)batory(dot)org(dot)pl>
Subject: Re: Spoofing as the postmaster
Date: 2007-12-23 13:55:37
Message-ID: 20071223135537.GC10545@svana.org (view raw or flat)
Thread:
Lists: pgsql-hackers
On Sat, Dec 22, 2007 at 02:21:42PM -0500, Tom Lane wrote:
> No, we shouldn't, and if I had any authority over them I would make
> Debian stop doing that.  It amounts to a unilateral distro-specific
> change in the protocol, and I think it makes things *less* secure,
> because any clients who are expecting the socket to be in /tmp will be
> easy pickings for a spoofer.  Debian cannot hope to prevent that
> scenario, because there are non-libpq-based client implementations.

Well, it's worked for many years and a little late to change now. It's
arguably safer, since only postmasters owned by "postgres" can create a
socket in that directory, any client attempting to connect to a server
using that directory knows it's connecting to a server owned by
'postgres'.

I can't think of any non-libpq clients which support Unix domain
sockets?

Have a nice day,
-- 
Martijn van Oosterhout   <kleptog(at)svana(dot)org>   http://svana.org/kleptog/
> Those who make peaceful revolution impossible will make violent revolution inevitable.
>  -- John F Kennedy

In response to

Responses

pgsql-hackers by date

Next:From: Magnus HaganderDate: 2007-12-23 14:07:44
Subject: Re: Spoofing as the postmaster
Previous:From: Peter EisentrautDate: 2007-12-23 13:35:01
Subject: Re: Spoofing as the postmaster

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group