| From: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> |
|---|---|
| To: | Jaime Casanova <jcasanov(at)systemguards(dot)com(dot)ec> |
| Cc: | Simon Riggs <simon(at)2ndquadrant(dot)com>, pgsql-hackers(at)postgresql(dot)org |
| Subject: | Re: Thoughts on pg_hba.conf rejection |
| Date: | 2010-04-07 15:43:44 |
| Message-ID: | 15661.1270655024@sss.pgh.pa.us |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
Jaime Casanova <jcasanov(at)systemguards(dot)com(dot)ec> writes:
> On Wed, Apr 7, 2010 at 10:46 AM, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
>> It's intentional. We try to expose the minimum amount of knowledge
>> about the contents of pg_hba.conf to potential attackers.
> i just tried it in CVS and in 8.4 and when i put a reject rule on
> pg_hba.conf what i get is:
> psql: FATAL: no pg_hba.conf entry for host "127.0.0.1", user "mic",
> database "mic"
> so we are giving a lot of info already
All three of those data values are known to the client; they don't add
knowledge about what is in pg_hba.conf.
regards, tom lane
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Nicolas Barbier | 2010-04-07 15:44:29 | Re: system table/view and sequence |
| Previous Message | Jaime Casanova | 2010-04-07 15:41:23 | Re: Thoughts on pg_hba.conf rejection |