Re: Logging of matching pg_hba.conf entry during auth skips trust auth, potential security issue - Mailing list pgsql-hackers

From Stephen Frost
Subject Re: Logging of matching pg_hba.conf entry during auth skips trust auth, potential security issue
Date
Msg-id ZN5EVlL9ozTBJm8e@tamriel.snowman.net
Whole thread Raw
In response to Re: Logging of matching pg_hba.conf entry during auth skips trust auth, potential security issue  (Jacob Champion <jchampion@timescale.com>)
Responses Re: Logging of matching pg_hba.conf entry during auth skips trust auth, potential security issue
List pgsql-hackers
Greetings,

* Jacob Champion (jchampion@timescale.com) wrote:
> Maybe something like the attached?

> - I used the phrasing "connection not authenticated" in the hopes that
> it's a bit more greppable than just "connection", especially in
> combination with the existing "connection authenticated" lines.

That doesn't seem quite right ... admittedly, 'trust' isn't performing
authentication but there can certainly be an argument made that the
basic 'matched a line in pg_hba.conf' is a form of authentication, and
worse really, saying 'not authenticated' would seem to imply that we
didn't allow the connection when, really, we did, and that could be
confusing to someone.

Maybe 'connection allowed' instead..?

Thanks,

Stephen

Attachment

pgsql-hackers by date:

Previous
From: Nathan Bossart
Date:
Subject: Re: [PATCH] Add function to_oct
Next
From: Nathan Bossart
Date:
Subject: Re: Using defines for protocol characters