Sorry, wrong email. Nothing applied. ---------------------------------------------------------------------------
Henry B. Hotz wrote: > I know I haven't been very active for a while here, but I just got to > testing the October 3 version a bit prior to getting back to the Java > GSS client stuff I promised. There seem to be some funny things there. > > The only serious issue is that the server doesn't require the realm > name to match. I haven't looked at how that broke yet, but I know I > was careful of that point in my original patches because it's always > been wrong in the Kerberos 5 auth method. > > If I set up a server I might conceivably get connections from: > > [EMAIL PROTECTED] > [EMAIL PROTECTED] > [EMAIL PROTECTED] > [EMAIL PROTECTED] > [EMAIL PROTECTED] > <same for every other NASA center, HQ, plus a "fake" realm relating > to how NASA set up AD> > > Now the only two of those that *might* be the same person are the > first two, and that's only if the Stanford person has a grant to work > on a JPL project and got put in our infrastructure as an affiliate, > *and* the username wasn't already taken. > > It appears that you can just put a complete (realm-included) name > into postgres, so that's obviously the way to support gssapi > connections from non-default realms. > > In short this is a security hole. IMO it should be fixed prior to > release. > > --------- > > I notice there are hba options for gss and sspi both. Why? > > Is there some windows-only functionality it enables? Shouldn't we be > using Microsoft's advertised GSSAPI/SSPI compatibility? If you build > on Windows then I'm sure you want to link the SSPI libraries rather > than require installation of a separate package, but that shouldn't > change the functionality or the wire protocol AFAIK. In other words > I would expect this to be a build-time option. > > --------- > > At the risk of diluting my message: I still think it's a mistake to > call it gss instead of something like gss-noprot. I believe this > will cause misunderstandings in the future when we get the security > layer of gssapi implemented. > > --------- > > There's no way to specify the gssapi library to use. I have three on > my main development Sun: MIT, Sun, and Heimdal. I might have more > than one version of one of those three at some times. Of course > there's no way to specify which kerberos 5 library or openssl library > you want either, so consider this a feature request for future > development. > > ------------------------------------------------------------------------ > The opinions expressed in this message are mine, > not those of Caltech, JPL, NASA, or the US Government. > [EMAIL PROTECTED], or [EMAIL PROTECTED] > > > > ---------------------------(end of broadcast)--------------------------- > TIP 3: Have you checked our extensive FAQ? > > http://www.postgresql.org/docs/faq -- Bruce Momjian <[EMAIL PROTECTED]> http://momjian.us EnterpriseDB http://postgres.enterprisedb.com + If your life is a hard drive, Christ can be your backup. + ---------------------------(end of broadcast)--------------------------- TIP 3: Have you checked our extensive FAQ? http://www.postgresql.org/docs/faq
