psql and security

From: Tatsuo Ishii <t-ishii(at)sra(dot)co(dot)jp>
To: pgsql-hackers(at)postgreSQL(dot)org
Subject: psql and security
Date: 2001-09-21 10:56:27
Message-ID: 20010921195627C.t-ishii@sra.co.jp
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-general pgsql-hackers

Hi,

This is not a real security issue but it seems not very appropreate
behavior for me.

$ psql -U foo test
Password: XXX

Welcome to psql, the PostgreSQL interactive terminal.

Type: \copyright for distribution terms
\h for help with SQL commands
\? for help on internal slash commands
\g or terminate with semicolon to execute query
\q to quit

test=> \c - postgres
You are now connected as new user postgres

As you can see, psql reconnect as any user if the password is same as
foo. Of course this is due to the careless password setting, but I
think it's better to prompt ANY TIME the user tries to switch to
another user. Comments?
--
Tatsuo Ishii

Responses

Browse pgsql-general by date

  From Date Subject
Next Message Colin 't Hart 2001-09-21 12:08:44 Re: [HACKERS] psql and security
Previous Message Tille, Andreas 2001-09-21 10:18:40 Hardware tuning (Was: Performance question)

Browse pgsql-hackers by date

  From Date Subject
Next Message Horak Daniel 2001-09-21 11:05:41 Re: Further CVS errors
Previous Message Tatsuo Ishii 2001-09-21 10:40:01 Re: Multibyte regression tests broken?