Bug#551389: [Nsspampgsql-devel] Bug#551389: libnss-pgsql2: Public auth info in the nss-pgsql.conf allows Denial-of-Service attack to NSS

[Stephen Gran]

This one time, at band camp, Denis Feklushkin said:
> Any local user can completely disable NSS resolution in DB by changing
> the password to the database.
> 
> Unlike mysql, postgres does not allow create a user ("role") which has
> no possibility to change own password (so-called "anonymous user").
> 
> Thus, any local user can obtain password from /etc/nss-pgsql.conf,
> change it and access to the DB will be corrupted

OK, I'll bite - why are you not making access to the database 'trust' in
pg_hba.conf?

And why is a misconfiguration of postgres a bug in nss-pgsql?

Cheers,
-- 
 -----------------------------------------------------------------
|   ,''`.                                            Stephen Gran |
|  : :' :                                        sg...@debian.org |
|  `. `'                        Debian user, admin, and developer |
|    `-                                     http://www.debian.org |
 -----------------------------------------------------------------

signature.asc
Description: Digital signature