diff options
| author | Peter Eisentraut <peter_e@gmx.net> | 2010-07-18 11:37:26 +0000 |
|---|---|---|
| committer | Peter Eisentraut <peter_e@gmx.net> | 2010-07-18 11:37:26 +0000 |
| commit | 040aee295ef66ce772050c99902e424d99c2124b (patch) | |
| tree | ac1853909ff3f7a881318739f6df1041b14c5a5d /doc/src | |
| parent | ed92bec07983931f856214a70982cc0382c464a1 (diff) | |
| download | postgresql-040aee295ef66ce772050c99902e424d99c2124b.tar.gz postgresql-040aee295ef66ce772050c99902e424d99c2124b.zip | |
Add server authentication over Unix-domain sockets
This adds a libpq connection parameter requirepeer that specifies the user
name that the server process is expected to run under.
reviewed by KaiGai Kohei
Diffstat (limited to 'doc/src')
| -rw-r--r-- | doc/src/sgml/libpq.sgml | 34 |
1 files changed, 33 insertions, 1 deletions
diff --git a/doc/src/sgml/libpq.sgml b/doc/src/sgml/libpq.sgml index 595cb0bb55b..ad56b84828b 100644 --- a/doc/src/sgml/libpq.sgml +++ b/doc/src/sgml/libpq.sgml @@ -1,4 +1,4 @@ -<!-- $PostgreSQL: pgsql/doc/src/sgml/libpq.sgml,v 1.314 2010/07/14 17:09:45 tgl Exp $ --> +<!-- $PostgreSQL: pgsql/doc/src/sgml/libpq.sgml,v 1.315 2010/07/18 11:37:25 petere Exp $ --> <chapter id="libpq"> <title><application>libpq</application> - C Library</title> @@ -509,6 +509,28 @@ </listitem> </varlistentry> + <varlistentry id="libpq-connect-requirepeer" xreflabel="requirepeer"> + <term><literal>requirepeer</literal></term> + <listitem> + <para> + For Unix-domain socket connections, if this parameter is + set, the client checks at the beginning of the connection + that the server process runs under the specified user name, + otherwise the connection is aborted with an error. This + parameter can be used to achieve the kind of server + authentication that SSL certificates achieve on TCP/IP + connections. (Note that if the Unix-domain socket is + in <filename>/tmp</filename> or another publically writable + location, any user could start a server there. Use this + parameter to ensure that you are connected to a server run + by a trusted user, + e.g., <literal>requirepeer=postgres</literal>.) This + option is only supported on some platforms, currently + Linux, FreeBSD, NetBSD, OpenBSD, and Solaris. + </para> + </listitem> + </varlistentry> + <varlistentry id="libpq-connect-krbsrvname" xreflabel="krbsrvname"> <term><literal>krbsrvname</literal></term> <listitem> @@ -6142,6 +6164,16 @@ myEventProc(PGEventId evtId, void *evtInfo, void *passThrough) <listitem> <para> <indexterm> + <primary><envar>PGREQUIREPEER</envar></primary> + </indexterm> + <envar>PGREQUIREPEER</envar> behaves the same as the <xref + linkend="libpq-connect-requirepeer"> connection parameter. + </para> + </listitem> + + <listitem> + <para> + <indexterm> <primary><envar>PGKRBSRVNAME</envar></primary> </indexterm> <envar>PGKRBSRVNAME</envar> behaves the same as the <xref |