Re: [HACKERS] PAM authentication fails for local UNIX users

Hi all,

This is the continuation to the discussion that we had in the hacker's list.

http://www.postgresql.org/docs/8.2/interactive/auth-methods.html#AUTH-PAM
Here, I like to add some details in 20.2.6. PAM authentication section.

Can someone review and make changes, if required? Thanks.

*** client-auth.sgml.orig       Tue Aug 21 16:52:45 2007
--- client-auth.sgml    Tue Aug 21 17:02:52 2007
***************
*** 987,992 ****
--- 987,1001 ----
      and the <ulink url="http://www.sun.com/software/solaris/pam/">
      <systemitem class="osname">Solaris</> PAM Page</ulink>.
     </para>
+
+    <note>
+     <para>
+      The local UNIX user authentication is not permitted,
+      because the postgres server is started by a non-root user.
+      In order to enable this functionality, the root user must provide
+      additional permissions to the postgres user (for reading
/etc/shadow file).
+     </para>
+    </note>
    </sect2>
   </sect1>


>
>
> Zdenek Kotala wrote:
>>
>> The problem what Dhanaraj tries to address is how to secure solve
>> problem with PAM and local user. Other servers (e.g. sshd) allow to
>> run master under root (with limited privileges) and forked process
>> under normal user. But postgresql
>> requires start as non-root user. It limits to used common pattern.
>>
>> There is important question:
>>
>> Is current requirement to run postgresql under non-root OK? If yes,
>> than we must update PAM documentation to explain this situation which
>> will never works secure. Or if we say No, it is stupid limitation (in
>> case when UID 0 says nothing about user's privileges) then we must
>> start discussion about solution.
>>
>>
>
> For now I think we should update the docs. You really can't compare
> postgres with sshd - ssh connections are in effect autonomous. I
> suspect the changes involved in allowing us to  run as root and then
> give up privileges safely would be huge, and the gain quite small.
>
> I'd rather see an HBA fallback mechanism, which I suspect might
> overcome most of the  problems being encountered here.
>
> cheers
>
> andrew


--
================================
Dhanaraj M
x40049/+91-9880244950
Solaris RPE, Bangalore, India
http://blogs.sun.com/dhanarajm/
================================