Problem - any password accepted

Oliver Elphick wrote:

While experimenting just now, I seem to have found a weird problem with
passwords, in that _anything_ I type in is accepted as a valid password.

Here are the relevant bits of pg_hba.conf

# TYPE DATABASE USER CIDR-ADDRESS METHOD

hostnossl junk olly 127.0.0.1/32 trust
host all all 127.0.0.1/32 md5

2. TCP/IP access: this uses SSL so it skips the hostnossl line and hits
the next host line, which specifies an md5 password. Whatever I type is
accepted.

In the log I have:
2007-05-30 17:54:59 BST LOG: could not receive data from client: Connection res
et by peer
2007-05-30 17:55:02 BST FATAL: password authentication failed for user "olly"

but it has still let me in.

Is it not falling back to non-SSL access, and so letting you through
with "trust"?

With a libpq call you could set "sslmode", but I'm not sure if you can
do that from the command-line.

--
Richard Huxton
Archonet Ltd

On Wed, May 30, 2007 at 05:58:24PM +0100, Oliver Elphick wrote:

While experimenting just now, I seem to have found a weird problem with
passwords, in that _anything_ I type in is accepted as a valid password.

# TYPE DATABASE USER CIDR-ADDRESS METHOD
# IPv4 local connections:
hostnossl junk olly 127.0.0.1/32 trust

Looks to me you're matching this line ^^^

2. TCP/IP access: this uses SSL so it skips the hostnossl line and hits
the next host line, which specifies an md5 password. Whatever I type is
accepted.

When SSL fails, it retries as non-SSL.

In the log I have:
2007-05-30 17:54:59 BST LOG: could not receive data from client: Connection res
et by peer
2007-05-30 17:55:02 BST FATAL: password authentication failed for user "olly"

Those lines are the failure of the SSL connection, the successful
connection is just fine.

Have a nice day,
--
Martijn van Oosterhout <kleptog@svana.org> http://svana.org/kleptog/

On Wed, 2007-05-30 at 19:38 +0200, Martijn van Oosterhout wrote:

On Wed, May 30, 2007 at 05:58:24PM +0100, Oliver Elphick wrote:

While experimenting just now, I seem to have found a weird problem with
passwords, in that _anything_ I type in is accepted as a valid password.

# TYPE DATABASE USER CIDR-ADDRESS METHOD
# IPv4 local connections:
hostnossl junk olly 127.0.0.1/32 trust

Looks to me you're matching this line ^^^

2. TCP/IP access: this uses SSL so it skips the hostnossl line and hits
the next host line, which specifies an md5 password. Whatever I type is
accepted.

When SSL fails, it retries as non-SSL.

In the log I have:
2007-05-30 17:54:59 BST LOG: could not receive data from client: Connection res
et by peer
2007-05-30 17:55:02 BST FATAL: password authentication failed for user "olly"

Those lines are the failure of the SSL connection, the successful
connection is just fine.

I didn't realise it retried.

Thanks

--
Oliver Elphick olly@lfix.co.uk
Isle of Wight http://www.lfix.co.uk/oliver
GPG: 1024D/A54310EA 92C8 39E7 280E 3631 3F0E 1EC0 5664 7A2F A543 10EA
========================================
Do you want to know God? http://www.lfix.co.uk/knowing_god.html

Richard Huxton <dev@archonet.com> writes:

With a libpq call you could set "sslmode", but I'm not sure if you can
do that from the command-line.

I think you can set it via a PGSSLMODE environment variable.

regards, tom lane