Re: Storing the password in .pgpass file in an encrypted format
От
Jeff Janes
Тема
Re: Storing the password in .pgpass file in an encrypted format
Дата
Msg-id
CAMkU=1wdab41eT7tCHSL7gC7grht9A2ThN9-w2qSwzLMu0rz5g@mail.gmail.com
Ответ на
Re: Storing the password in .pgpass file in an encrypted
format (Alvaro Herrera)
Список
Дерево обсуждения
Storing the password in .pgpass file in an encrypted format firoz e v <firoz.ev@huawei.com>
Re: Storing the password in .pgpass file in an encrypted
format Alvaro Herrera <alvherre@2ndquadrant.com>
Re: Storing the password in .pgpass file in an encrypted
format Christian Kruse <christian@2ndQuadrant.com>
Re: Storing the password in .pgpass file in an encrypted
format Euler Taveira <euler@timbira.com.br>
Re: Storing the password in .pgpass file in an encrypted
format Alvaro Herrera <alvherre@2ndquadrant.com>
Re: Storing the password in .pgpass file in an encrypted
format Andres Freund <andres@2ndquadrant.com>
Re: Storing the password in .pgpass file in an encrypted format Jeff Janes <jeff.janes@gmail.com>
Re: Storing the password in .pgpass file in an encrypted
format Alvaro Herrera <alvherre@2ndquadrant.com>
Re: Storing the password in .pgpass file in an encrypted
format Craig Ringer <craig@2ndquadrant.com>
Re: Storing the password in .pgpass file in an encrypted format Jeff Janes <jeff.janes@gmail.com>
Re: Storing the password in .pgpass file in an encrypted format Szymon Guz <mabewlun@gmail.com>
Re: Storing the password in .pgpass file in an encrypted format Christopher Browne <cbbrowne@gmail.com>
Re: Storing the password in .pgpass file in an encrypted
format Craig Ringer <craig@2ndquadrant.com>
Re: Storing the password in .pgpass file in an encrypted
format "Tomas Vondra" <tv@fuzzy.cz>
Re: Storing the password in .pgpass file in an encrypted
format Alvaro Herrera <alvherre@2ndquadrant.com>
Re: Storing the password in .pgpass file in an encrypted format Daniel Farina <daniel@heroku.com>
Re: Storing the password in .pgpass file in an encrypted format Greg Stark <stark@mit.edu>
Re: Storing the password in .pgpass file in an encrypted format Daniel Farina <daniel@heroku.com>
On Fri, Feb 21, 2014 at 7:04 AM, Alvaro Herrera <alvherre@2ndquadrant.com> wrote:
Euler Taveira wrote:How would that work? libpq needs the straight password to send to the
> On 21-02-2014 09:49, firoz e v wrote:
> > Even though, there are ways to set the permissions on .pgpass, to disallow any access to world or group, the security rules of many organizations disallow to hold any kind of passwords, as plain text.
> >
> Is your goal hiding the password in .pgpass? You could add support to
> accept md5... storage format as password.
server, not an encrypted one.
It looks like that is the way it is currently written, but it does not have to be that way, at least for "md5" rather than "password" authentication.
If you were to have a mechanism by which
libpq can store an md5'd password (or whatever hash) and send that md5
to the server and have the server accept it to grant a connection, then
the md5 has, in effect, become the unencrypted password which others can
capture from the file, and you're back at square one.
The string in .pgpass would be enough for people to log into postgresql, true. But it would not work to log onto other things which share the same clear-text password but don't share the same salting mechanism.
Cheers,
Jeff
В списке pgsql-hackers по дате отправления
