diff options
| author | Tom Lane | 2020-12-30 16:38:42 +0000 |
|---|---|---|
| committer | Tom Lane | 2020-12-30 16:38:42 +0000 |
| commit | 860fe27ee1e2a4a1c36c2f874c37656533cccce9 (patch) | |
| tree | cbf3f64b956e54753feade50c056f67ea69b7d97 /src/backend/utils/misc/postgresql.conf.sample | |
| parent | e665769e6d1e84b6650f53ed297058fc11152f7f (diff) | |
Fix up usage of krb_server_keyfile GUC parameter.
secure_open_gssapi() installed the krb_server_keyfile setting as
KRB5_KTNAME unconditionally, so long as it's not empty. However,
pg_GSS_recvauth() only installed it if KRB5_KTNAME wasn't set already,
leading to a troubling inconsistency: in theory, clients could see
different sets of server principal names depending on whether they
use GSSAPI encryption. Always using krb_server_keyfile seems like
the right thing, so make both places do that. Also fix up
secure_open_gssapi()'s lack of a check for setenv() failure ---
it's unlikely, surely, but security-critical actions are no place
to be sloppy.
Also improve the associated documentation.
This patch does nothing about secure_open_gssapi()'s use of setenv(),
and indeed causes pg_GSS_recvauth() to use it too. That's nominally
against project portability rules, but since this code is only built
with --with-gssapi, I do not feel a need to do something about this
in the back branches. A fix will be forthcoming for HEAD though.
Back-patch to v12 where GSSAPI encryption was introduced. The
dubious behavior in pg_GSS_recvauth() goes back further, but it
didn't have anything to be inconsistent with, so let it be.
Discussion: https://postgr.es/m/[email protected]
Diffstat (limited to 'src/backend/utils/misc/postgresql.conf.sample')
| -rw-r--r-- | src/backend/utils/misc/postgresql.conf.sample | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sample index b7fb2ec1feb..5298e18ecd5 100644 --- a/src/backend/utils/misc/postgresql.conf.sample +++ b/src/backend/utils/misc/postgresql.conf.sample @@ -92,7 +92,7 @@ #db_user_namespace = off # GSSAPI using Kerberos -#krb_server_keyfile = '' +#krb_server_keyfile = 'FILE:${sysconfdir}/krb5.keytab' #krb_caseins_users = off # - SSL - |