Skip site navigation (1) Skip section navigation (2)

Re: [HACKERS] SSL over Unix-domain sockets

From: Bruce Momjian <bruce(at)momjian(dot)us>
To: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
Cc: Alvaro Herrera <alvherre(at)commandprompt(dot)com>, Andrew Dunstan <andrew(at)dunslane(dot)net>, Peter Eisentraut <peter_e(at)gmx(dot)net>, PostgreSQL-patches <pgsql-patches(at)postgresql(dot)org>, Mark Mielke <mark(at)mark(dot)mielke(dot)cc>
Subject: Re: [HACKERS] SSL over Unix-domain sockets
Date: 2008-01-31 17:32:46
Message-ID: 200801311732.m0VHWk706279@momjian.us (view raw or flat)
Thread:
Lists: pgsql-hackerspgsql-patches
Tom Lane wrote:
> Bruce Momjian <bruce(at)momjian(dot)us> writes:
> > I am confused because you say "dangling" then you say "to the real
> > socket".  You are saying it isn't dangling when the server is running?
> 
> Exactly.  When the server is running it provides a perfectly good path
> to the postmaster.  The point (and the main difference from your PIDfile
> proposal) is that it's supposed to be there all the time, even when the
> postmaster isn't running.  This is what provides protection against the
> spoofer getting there first.

OK, I have added documention suggesting the creation a symbolic link in
/tmp to prevent server spoofing when the socket file has been moved.

I think we can consider this issue concluded.  I think SSL over unix
domain sockets has so much overhead as to be worse in most cases than
just creating the symlink.

Of course if someone comes up with a better idea we can reopen this.

-- 
  Bruce Momjian  <bruce(at)momjian(dot)us>        http://momjian.us
  EnterpriseDB                             http://postgres.enterprisedb.com

  + If your life is a hard drive, Christ can be your backup. +

Attachment: /rtmp/diff
Description: text/x-diff (1.7 KB)

In response to

pgsql-hackers by date

Next:From: Roberts, JonDate: 2008-01-31 18:28:04
Subject: Re: timestamp format bug
Previous:From: Heikki LinnakangasDate: 2008-01-31 16:55:48
Subject: Re: [PATCHES] Better default_statistics_target

pgsql-patches by date

Next:From: Robert TreatDate: 2008-02-01 04:19:59
Subject: Re: [PATCHES] Better default_statistics_target
Previous:From: Heikki LinnakangasDate: 2008-01-31 16:55:48
Subject: Re: [PATCHES] Better default_statistics_target

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group