Skip site navigation (1) Skip section navigation (2)

Re: SSL over Unix-domain sockets

From: Martijn van Oosterhout <kleptog(at)svana(dot)org>
To: Peter Eisentraut <peter_e(at)gmx(dot)net>
Cc: pgsql-hackers(at)postgresql(dot)org, Bruce Momjian <bruce(at)momjian(dot)us>
Subject: Re: SSL over Unix-domain sockets
Date: 2009-04-01 17:37:56
Message-ID: 20090401173756.GB21229@svana.org (view raw or flat)
Thread:
Lists: pgsql-hackers
On Tue, Mar 31, 2009 at 11:33:26PM +0300, Peter Eisentraut wrote:
> On Saturday 28 March 2009 00:42:28 Bruce Momjian wrote:
> > I assume directory permissions controlling access to the socket file
> > would be enough.  You are going to have to set up SSL certificates
> > anyway for this so isn't that just as hard as telling the client where
> > the socket file is located?
> 
> The permissions on the socket file or the containing directory doesn't tell 
> much by itself, because you also need to consider who owns it.  What that 
> basically comes down to is that the client would need to specify something 
> like, "I only want a connection to a server owned by 'postgres'."  But the 
> client currently has no way of saying that, so we'd need to invent something 
> new.

If you're going to get complicated, go the whole way do SO_PEERCRED on
the socket, then you get the UID of the server...

Have a nice day,
-- 
Martijn van Oosterhout   <kleptog(at)svana(dot)org>   http://svana.org/kleptog/
> Please line up in a tree and maintain the heap invariant while 
> boarding. Thank you for flying nlogn airlines.

In response to

Responses

pgsql-hackers by date

Next:From: Vincze, TamasDate: 2009-04-01 18:18:13
Subject: Re: Patch to speed up pg_dump
Previous:From: Tom LaneDate: 2009-04-01 17:36:40
Subject: Re: More message encoding woes

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group