Thread

1. Re: [HACKERS] Re: New pg_pwd patch and stuff

   Zeugswetter Andreas <andreas.zeugswetter@telecom.at> — 1998-01-16T09:33:00Z

   > > 
   > > >         Fork off the postgres process first, then authenticate
   inside of
   > > > there...which would get rid of the problem with pg_user itself
   being a
   > > > text file vs a relation...no?
   > > 
   > > Yes, yes, yes.  This is how authentication should be done (for HBA,
   etc.)
   > 
   > No, no, no! For security reasons, you can't fork (and exec)
   > unauthenticated processes. Especially HBA authentication should be
   done
   > to consume as low resources as possbile.
   
   Startup time for a valid connect client is now < 0.16 secs, so is this
   really a threat ?
   I would say might leave hba to postmaster (since postgres don't need to
   know about it)
   then fork off postgres and do the rest of the authentication. 
   
   Running postgres as root though is a **very** bad idea.
   Remember that we have user defined Functions !
   
   no, yes, yes 
   Andreas
   
   

2. Re: [HACKERS] Re: New pg_pwd patch and stuff

   Marc G. Fournier <scrappy@hub.org> — 1998-01-16T13:08:02Z

   On Fri, 16 Jan 1998, Zeugswetter Andreas DBT wrote:
    
   > Running postgres as root though is a **very** bad idea.
   > Remember that we have user defined Functions !
   
   	postmaster nor postgres will run as root, so I'm not sure where
   you are coming up with a "Running postgres as root..." problem :(