Re: Logging of matching pg_hba.conf entry during auth skips trust auth, potential security issue

From: Michael Paquier <michael(at)paquier(dot)xyz>
To: Robert Haas <robertmhaas(at)gmail(dot)com>
Cc: Stephen Frost <sfrost(at)snowman(dot)net>, Jacob Champion <jchampion(at)timescale(dot)com>, Shaun Thomas <shaun(dot)thomas(at)enterprisedb(dot)com>, pgsql-hackers(at)postgresql(dot)org
Subject: Re: Logging of matching pg_hba.conf entry during auth skips trust auth, potential security issue
Date: 2023-08-21 23:04:18
Message-ID: ZOPtck3RRchSzQR8@paquier.xyz
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

On Mon, Aug 21, 2023 at 09:27:51AM -0400, Robert Haas wrote:
> + * No authentication identity was set; this happens e.g. when the
> + * trust method is in use. For audit purposes, log a breadcrumb to
> + * explain where in the HBA this happened.
>
> Proposed rewrite: "Normally, if log_connections is set, the call to
> set_authn_id will log the connection. However, if that function is
> never called, perhaps because the trust method is in use, then we
> handle the logging here instead."

WFM.
--
Michael

In response to

Browse pgsql-hackers by date

  From Date Subject
Next Message Michael Paquier 2023-08-21 23:22:36 Re: Logging of matching pg_hba.conf entry during auth skips trust auth, potential security issue
Previous Message Bruce Momjian 2023-08-21 22:07:54 Re: PG 16 draft release notes ready