From: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> |
---|---|
To: | Magnus Hagander <magnus(at)hagander(dot)net> |
Cc: | Alan DeKok <aland(at)freeradius(dot)org>, pgsql-bugs(at)postgresql(dot)org |
Subject: | Re: BUG #5687: RADIUS Authentication issues |
Date: | 2010-10-03 14:56:26 |
Message-ID: | 503.1286117786@sss.pgh.pa.us |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-bugs |
Magnus Hagander <magnus(at)hagander(dot)net> writes:
> On Sun, Oct 3, 2010 at 00:52, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
>> [ scratches head ... ] I don't see the problem.
> I think he's referring to the ability to flood the postgresql server
> with radius packets with spoofed IP source, correct?
Hm ... seems to me that is a network security problem, not our problem.
Who's to say one of the spoofed packets won't pass verification?
> If we then looped
> until we got one that validated as a proper packet, we'd still be able
> to authenticate with that one, just throwing the invalid ones away.
> Notice how the "read packet" part is moved inside the loop in his
> suggestion.
If you want to change it, I won't stand in the way, but I have real
doubts about both the credibility of this threat and the usefulness
of the proposed fix.
regards, tom lane
From | Date | Subject | |
---|---|---|---|
Next Message | Tony marston | 2010-10-03 16:16:05 | BUG #5690: pg_upgrade fails |
Previous Message | Andrea Peri | 2010-10-03 09:11:29 | Re: Postgres 9.0 crash on win7 |