Re: SSL over Unix-domain sockets

From: Alvaro Herrera <alvherre(at)commandprompt(dot)com>
To: Bruce Momjian <bruce(at)momjian(dot)us>
Cc: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, Peter Eisentraut <peter_e(at)gmx(dot)net>, Mark Mielke <mark(at)mark(dot)mielke(dot)cc>, pgsql-hackers(at)postgresql(dot)org
Subject: Re: SSL over Unix-domain sockets
Date: 2008-01-15 12:05:45
Message-ID: 20080115120545.GA4473@alvh.no-ip.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers pgsql-patches

Bruce Momjian wrote:

> My feeling on the moving of sockets risk is that you are probably going
> to have all your clients using the new socket directory before anyone
> tries to put something in /tmp, especially if you have the lock file in
> /tmp as outlined above. To spoof in such a situation you would need to
> do the attack while the server is down _and_ against a client that
> doesn't know the right socket location.

Perhaps the easiest thing to do is to create a (possibly dangling)
symlink in /tmp to the real socket in a protected dir. This symlink
would be created at start time by an early init script and never
deleted.

So when postmaster is down, the symlink is dangling but it cannot be
overwritten by the attacker. And when postmaster is running, the client
can find the true socket via either path.

One thing to be aware of is /tmp cleaners ...

--
Alvaro Herrera http://www.CommandPrompt.com/
PostgreSQL Replication, Consulting, Custom Development, 24x7 support

In response to

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Alvaro Herrera 2008-01-15 12:21:21 Re: SSL over Unix-domain sockets
Previous Message Magnus Hagander 2008-01-15 09:25:53 Re: could not open relation: Invalid argument

Browse pgsql-patches by date

  From Date Subject
Next Message Alvaro Herrera 2008-01-15 12:21:21 Re: SSL over Unix-domain sockets
Previous Message Sokolov Yura 2008-01-15 11:28:37 Re: BUG #3860: xpath crashes backend when is querying xmlagg result