Re: [HACKERS] psql and security

2001-10-11 Thread Bruce Momjian
Patch applied. Thanks Tatsuo and Tom. > Tatsuo Ishii <[EMAIL PROTECTED]> writes: > > As you can see, psql reconnect as any user if the password is same as > > foo. Of course this is due to the careless password setting, but I > > think it's better to prompt ANY TIME the user tries to switch to

Re: [HACKERS] psql and security

2001-09-21 Thread Peter Eisentraut
Tom Lane writes: > No, I think you're missing the point --- we're concerned about > reconnecting as a different user, not reconnecting to a different > database. Oh, of course. I agree, in that case the password shouldn't be reused. -- Peter Eisentraut [EMAIL PROTECTED] http://funkturm.ho

Re: [HACKERS] psql and security

2001-09-21 Thread Tom Lane
Peter Eisentraut <[EMAIL PROTECTED]> writes: > concluding that this password is valid for all databases is trivial since > that's the default setup. No, I think you're missing the point --- we're concerned about reconnecting as a different user, not reconnecting to a different database. The issu

Re: [HACKERS] psql and security

2001-09-21 Thread Tom Lane
Tatsuo Ishii <[EMAIL PROTECTED]> writes: > As you can see, psql reconnect as any user if the password is same as > foo. Of course this is due to the careless password setting, but I > think it's better to prompt ANY TIME the user tries to switch to > another user. Comments? Yeah, I agree. Looks

Re: [HACKERS] psql and security

2001-09-21 Thread Zeugswetter Andreas SB SD
> > As you can see, psql reconnect as any user if the password is same as > > foo. Of course this is due to the careless password setting, but I > > think it's better to prompt ANY TIME the user tries to switch to > > another user. > > I'm not sure. A few users have voiced concerns about this b

Re: [HACKERS] psql and security

2001-09-21 Thread Peter Eisentraut
Tatsuo Ishii writes: > As you can see, psql reconnect as any user if the password is same as > foo. Of course this is due to the careless password setting, but I > think it's better to prompt ANY TIME the user tries to switch to > another user. I'm not sure. A few users have voiced concerns abo

[HACKERS] psql and security

2001-09-21 Thread Tatsuo Ishii
Hi, This is not a real security issue but it seems not very appropreate behavior for me. $ psql -U foo test Password: XXX Welcome to psql, the PostgreSQL interactive terminal. Type: \copyright for distribution terms \h for help with SQL commands \? for help on internal slash com