| From: | Bruce Momjian <pgman(at)candle(dot)pha(dot)pa(dot)us> |
|---|---|
| To: | Neil Conway <neilc(at)samurai(dot)com> |
| Cc: | Josh Berkus <josh(at)agliodbs(dot)com>, "Arcadius A(dot)" <ahouans(at)sh(dot)cvut(dot)cz>, PostgreSQL Advocacy <pgsql-advocacy(at)postgresql(dot)org> |
| Subject: | Re: MySQL interview, no mention of PostgreSQL |
| Date: | 2003-10-17 11:23:07 |
| Message-ID: | 200310171123.h9HBN8Z05897@candle.pha.pa.us |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-advocacy |
Neil Conway wrote:
> On Thu, 2003-10-16 at 12:54, Josh Berkus wrote:
> > While one could write a utility in Postgres to create/process the file, the
> > "live" version of pg_hba.conf *must* be outside the database. If our ACL
> > was in the database, then how would we know who has the rights to read the
> > ACL?
>
> I don't see why this is a show-stopping problem. Can you elaborate?
We don't want to fire up a backend until we know this is a valid user.
You could easily bring a server to a standstill by just sending false
connection requests. Sure, you can still do that by flooding the
machine, but a database lookup is significantly more expensive than
checking a connection packet.
--
Bruce Momjian | http://candle.pha.pa.us
pgman(at)candle(dot)pha(dot)pa(dot)us | (610) 359-1001
+ If your life is a hard drive, | 13 Roberts Road
+ Christ can be your backup. | Newtown Square, Pennsylvania 19073
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Peter Eisentraut | 2003-10-17 11:40:09 | Re: Mapping Oracle types to PostgreSQL types |
| Previous Message | Arcadius A. | 2003-10-17 10:23:02 | Re: MySQL interview, no mention of PostgreSQL |