Tom Lane wrote:
> Bruce Momjian <bruce(at)momjian(dot)us> writes:
> > Agreed. Requiring client root certificate checking is heavy-handed.
> There seems to be some confusion here. I didn't think anyone was
> proposing that we force every installation to require client root
> certificate checking. What was under discussion (I thought) was
> providing the ability for a DBA to *choose* to require it.
Oh, yea, that would be OK. I am a little worried that the extra
configuration required to turn this on/off might be added complexity for
It might be simpler to allow the administrator to control whether
non-checking clients are logged, rather than refusing the connection. I
think this makes it clearer the root client check is to make sure all
your clients are doing it right, rather than an actual security
enhancement (if that makes sense).
> > Of course I am not sure anyone knows how to get that information from
> > SSL.
> Yeah, if OpenSSL doesn't support testing for this then the discussion
> is moot...
Bruce Momjian <bruce(at)momjian(dot)us> http://momjian.us
+ If your life is a hard drive, Christ can be your backup. +
In response to
pgsql-hackers by date
|Next:||From: Bruce Momjian||Date: 2007-12-29 03:44:49|
|Subject: Re: Spoofing as the postmaster|
|Previous:||From: Tom Lane||Date: 2007-12-29 03:10:18|
|Subject: Re: Spoofing as the postmaster |