On Mon, Jul 08, 2024 at 02:09:21PM -0700, Jacob Champion wrote: > On Sun, Jun 30, 2024 at 10:48 AM Noah Misch <n...@leadboat.com> wrote: > > That said, it > > may be more fruitful to arrange for authentication timeout to cut through > > PAM > > etc. > > That seems mostly out of our hands -- the misbehaving modules are free > to ignore our signals (and do). Is there another way to force the > issue?
Two ways at least (neither of them cheap): - Invoke PAM in a subprocess, and SIGKILL that process if needed. - Modify the module to be interruptible. > > Hanging connection slots hurt even if they lack an xmin. > > Oh, would releasing the xmin not really move the needle, then? It still moves the needle.
