Re: Indent authentication overloading

> We use it. Do you have an alternative that doesn't lower security
> besides Kerberos? Anti-ident arguments are straw man arguments - "If
> you setup identd badly or don't trust remote root or your network,
> ident sucks as an authentication mechanism".

Actually, you're trusting that nobody can add their own machine as a 
node on your network.  All someone has to do is plug their linux laptop 
into a network cable in your office and they have free access to the 
database.

> Ident is great as you don't have to lower security by dealing with
> keys on the client system (more management headaches == lower
> security), or worry about those keys being reused by accounts that
> shouldn't be reusing them. Please don't deprecate it unless there is
> an alternative. And if you are a pg_pool or pgbouncer maintainer,
> please consider adding support :)

I don't think anyone is talking about eliminating it, just 
distinguishing ident-over-TCP from unix-socket-same-user, which are 
really two different authentication mechanisms.

HOWEVER, I can't see any way of doing this which wouldn't cause a 
significant amount of backwards-compatibility confusion.  Given that 
users can distinguish between local and TCP ident in pg_hba.conf already 
(and the default pg_hba.conf does) it is worth the confusion it will cause?


--                                   -- Josh Berkus                                     PostgreSQL Experts Inc.
                           http://www.pgexperts.com