database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-28 23:42:10 +03:00
Code Activity

Add server authentication over Unix-domain sockets

Browse Source 
This adds a libpq connection parameter requirepeer that specifies the user
name that the server process is expected to run under.

reviewed by KaiGai Kohei
This commit is contained in:
Peter Eisentraut
2010-07-18 11:37:26 +00:00
parent ed92bec079
commit 040aee295e
3 changed files with 123 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
doc/src/sgml/libpq.sgml
View File

@ -1,4 +1,4 @@
<!-- $PostgreSQL: pgsql/doc/src/sgml/libpq.sgml,v 1.314 2010/07/14 17:09:45 tgl Exp $ -->
<!-- $PostgreSQL: pgsql/doc/src/sgml/libpq.sgml,v 1.315 2010/07/18 11:37:25 petere Exp $ -->
<chapter id="libpq">
<title><application>libpq</application> - C Library</title>
@ -509,6 +509,28 @@
</listitem>
</varlistentry>
<varlistentry id="libpq-connect-requirepeer" xreflabel="requirepeer">
<term><literal>requirepeer</literal></term>
<listitem>
<para>
For Unix-domain socket connections, if this parameter is
set, the client checks at the beginning of the connection
that the server process runs under the specified user name,
otherwise the connection is aborted with an error. This
parameter can be used to achieve the kind of server
authentication that SSL certificates achieve on TCP/IP
connections. (Note that if the Unix-domain socket is
in <filename>/tmp</filename> or another publically writable
location, any user could start a server there. Use this
parameter to ensure that you are connected to a server run
by a trusted user,
e.g., <literal>requirepeer=postgres</literal>.) This
option is only supported on some platforms, currently
Linux, FreeBSD, NetBSD, OpenBSD, and Solaris.
</para>
</listitem>
</varlistentry>
<varlistentry id="libpq-connect-krbsrvname" xreflabel="krbsrvname">
<term><literal>krbsrvname</literal></term>
<listitem>
@ -6139,6 +6161,16 @@ myEventProc(PGEventId evtId, void *evtInfo, void *passThrough)
</para>
</listitem>
<listitem>
<para>
<indexterm>
<primary><envar>PGREQUIREPEER</envar></primary>
</indexterm>
<envar>PGREQUIREPEER</envar> behaves the same as the <xref
linkend="libpq-connect-requirepeer"> connection parameter.
</para>
</listitem>
<listitem>
<para>
<indexterm>