Skip site navigation (1) Skip section navigation (2)

Re: Preliminary GSSAPI Patches

From: "Henry B(dot) Hotz" <hbhotz(at)oxy(dot)edu>
To: Magnus Hagander <magnus(at)hagander(dot)net>
Cc: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, Stephen Frost <sfrost(at)snowman(dot)net>, pgsql-patches(at)postgresql(dot)org
Subject: Re: Preliminary GSSAPI Patches
Date: 2007-10-10 18:35:00
Message-ID: D322B9F0-7A31-44BD-AE0D-7A0E6A67904C@oxy.edu (view raw or flat)
Thread:
Lists: pgsql-patches
I'm not suggesting any change.  Merely correcting a misstatement I  
made earlier.

I believe the documentation already recommends best practice.

On Oct 10, 2007, at 10:53 AM, Magnus Hagander wrote:

> Tom Lane wrote:
>> "Henry B. Hotz" <hbhotz(at)oxy(dot)edu> writes:
>>> You know, I don't know what I was thinking when I sent this.  My
>>> apologies for the late correction.
>>>
>>> Anyone who has a copy of the "host" keys for a machine can
>>> manufacture kerberos tickets for the "host" service on that machine
>>> masquerading as absolutely anyone (including people who don't
>>> exist).  Same for the "postgres" keys, and if the postgres server  
>>> can
>>> steal the host keys (or vice versa) then it's even worse.
>>> [snip...]
>>
>> Maybe I'm too dense, but I don't see a conclusion here.  Do we  
>> need to
>> change our code, our docs, both, or neither?
>
> I don't think we do. If you use service keys per our documentation,  
> you
> should be fine. And if someone owns your host keys, you lost already.
>
> //Magnus

------------------------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
Henry(dot)B(dot)Hotz(at)jpl(dot)nasa(dot)gov, or hbhotz(at)oxy(dot)edu



In response to

pgsql-patches by date

Next:From: Tom LaneDate: 2007-10-10 18:50:10
Subject: Re: Preliminary patch for tsearch example dictionaries/parsers in contrib
Previous:From: Sergey V. KarpovDate: 2007-10-10 18:24:55
Subject: Re: Preliminary patch for tsearch example dictionaries/parsers in contrib

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group