postgres

mirror of https://github.com/postgres/postgres.git synced 2025-12-07 12:02:30 +03:00

Files

Thomas Munro 96ed0b8704 Don't set PAM_RHOST for Unix sockets.

Since commit 2f1d2b7a we have set PAM_RHOST to "[local]" for Unix
sockets.  This caused Linux PAM's libaudit integration to make DNS
requests for that name.  It's not exactly clear what value PAM_RHOST
should have in that case, but it seems clear that we shouldn't set it
to an unresolvable name, so don't do that.

Back-patch to 9.6.  Bug #15520.

Author: Thomas Munro
Reviewed-by: Peter Eisentraut
Reported-by: Albert Schabhuetl
Discussion: https://postgr.es/m/15520-4c266f986998e1c5%40postgresql.org

2018-11-28 14:15:00 +13:00

auth-scram.c

Minor cleanup/future-proofing for pg_saslprep().

2018-09-08 18:20:36 -04:00

auth.c

Don't set PAM_RHOST for Unix sockets.

2018-11-28 14:15:00 +13:00

be-fsstubs.c

Fix saving and restoring umask

2017-09-23 10:03:05 -04:00

be-secure-openssl.c

Final pgindent + perltidy run for v10.

2017-08-14 17:29:33 -04:00

be-secure.c

Server-side fix for delayed NOTIFY and SIGTERM processing.

2018-10-19 21:39:21 -04:00

crypt.c

Don't allow logging in with empty password.

2017-08-07 17:03:42 +03:00

hba.c

Fix possible buffer overrun in hba.c.

2018-11-13 16:29:33 +13:00

ifaddr.c

Phase 2 of pgindent updates.

2017-06-21 15:19:25 -04:00

Makefile

Support SCRAM-SHA-256 authentication (RFC 5802 and 7677).

2017-03-07 14:25:40 +02:00

pg_hba.conf.sample

Rename "scram" to "scram-sha-256" in pg_hba.conf and password_encryption.

2017-04-18 14:50:50 +03:00

pg_ident.conf.sample

Reformat the comments in pg_hba.conf and pg_ident.conf

2010-01-26 06:58:39 +00:00

pqcomm.c

Second try at fixing tcp_keepalives_idle option on Solaris.

2017-06-28 12:30:16 -04:00

pqformat.c

2017-01-03 13:48:53 -05:00

pqmq.c

Clean up shm_mq cleanup.

2017-08-31 15:10:24 -04:00

pqsignal.c

2017-01-03 13:48:53 -05:00

README.SSL

Remove useless whitespace at end of lines

2010-11-23 22:34:55 +02:00

README.SSL

src/backend/libpq/README.SSL

SSL
===

>From the servers perspective:


  Receives StartupPacket
           |
           |
 (Is SSL_NEGOTIATE_CODE?) -----------  Normal startup
           |                  No
           |
           | Yes
           |
           |
 (Server compiled with USE_SSL?) ------- Send 'N'
           |                       No        |
           |                                 |
           | Yes                         Normal startup
           |
           |
        Send 'S'
           |
           |
      Establish SSL
           |
           |
      Normal startup





>From the clients perspective (v6.6 client _with_ SSL):


      Connect
         |
         |
  Send packet with SSL_NEGOTIATE_CODE
         |
         |
  Receive single char  ------- 'S' -------- Establish SSL
         |                                       |
         | '<else>'                              |
         |                                  Normal startup
         |
         |
   Is it 'E' for error  ------------------- Retry connection
         |                  Yes             without SSL
         | No
         |
   Is it 'N' for normal ------------------- Normal startup
         |                  Yes
         |
   Fail with unknown

---------------------------------------------------------------------------