From: | "Nigel J(dot) Andrews" <nandrews(at)investsystems(dot)co(dot)uk> |
---|---|
To: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> |
Cc: | pgsql-hackers(at)postgresql(dot)org |
Subject: | Re: host and hostssl equivalence in pg_hba.conf |
Date: | 2003-06-10 10:02:31 |
Message-ID: | Pine.LNX.4.21.0306101043310.2332-100000@ponder.fairway2k.co.uk |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-general pgsql-hackers |
How do people feel about changing matching for host and hostssl to be such that
a plain host line in pg_hba.conf does not allow a SSL connection but requires
the hostssl specifier?
I had been going to submit a very small patch to do this but then it occurred
to me this was a good candidate for a GUC along the lines of
allow_host_hostssl_equivalence (just a name picked out of the air for this
post). As this is a little bit more work and I can't get to anoncvs to refresh
my tree I thought I'd check if it was something to persue or forget.
To recap another thread I started, I had problems with large objects, Tom
suggested it might be SSL related as unix domain connections were fine, I
confirmed I still had the problem in 7.3.3 but then was unable to switch off
SSL for any IP connections without a rebuild as the host line in pg_hba.conf
permits SSL connections.
What I haven't done is confirm 7.4 has the problem (see the anoncvs comment
above).
I suggest this as GUC controlled feature since it seems from first impressions
that it is a lot more work to fall back to without SSL if there is a matching
host line but not a hostssl one. That is, connections from SSL enabled clients
would be rejected if there no hostssl entry for them, even if there was a
matching host entry, thus locking that client out of the server (unless there
was some way to tell the client to not attempt SSL).
Hmm...hope that's understandable, I seem to have rabbited on making this a lot
longer than I was expecting to.
--
Nigel Andrews
From | Date | Subject | |
---|---|---|---|
Next Message | Mattias Kregert | 2003-06-10 10:06:41 | Re: viewing the original (chrnological) order of entered records |
Previous Message | Sven Van Acker | 2003-06-10 09:50:11 | viewing the original (chrnological) order of entered records |
From | Date | Subject | |
---|---|---|---|
Next Message | Nigel J. Andrews | 2003-06-10 10:58:59 | Re: Proposal to Re-Order Postgresql.Conf, part II |
Previous Message | Hans-Jürgen Schönig | 2003-06-10 07:59:14 | Re: Groups and roles |