Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitf9bd3b6

Browse files
committed
Avoid logging complaints about abandoned connections when using PAM.
For a long time (since commitaed378e) we have had a policy to lognothing about a connection if the client disconnects when challengedfor a password. This is because libpq-using clients will typicallydo that, and then come back for a new connection attempt once they'vecollected a password from their user, so that logging the abandonedconnection attempt will just result in log spam. However, this didnot work well for PAM authentication: the bottom-level functionpam_passwd_conv_proc() was on board with it, but we logged messagesat higher levels anyway, for lack of any reporting mechanism.Add a flag and tweak the logic so that the case is silent, as it isfor other password-using auth mechanisms.Per complaint from Yoann La Cancellera. It's been like this for awhile,so back-patch to all supported branches.Discussion:https://postgr.es/m/CACP=ajbrFFYUrLyJBLV8=q+eNCapa1xDEyvXhMoYrNphs-xqPw@mail.gmail.com
1 parent7918641 commitf9bd3b6

File tree

1 file changed

+17
-9
lines changed

1 file changed

+17
-9
lines changed

‎src/backend/libpq/auth.c

Lines changed: 17 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,7 @@ static const char *pam_passwd = NULL;/* Workaround for Solaris 2.6
105105
* brokenness */
106106
staticPort*pam_port_cludge;/* Workaround for passing "Port *port" into
107107
* pam_passwd_conv_proc */
108+
staticboolpam_no_password;/* For detecting no-password-given */
108109
#endif/* USE_PAM */
109110

110111

@@ -2087,8 +2088,10 @@ pam_passwd_conv_proc(int num_msg, const struct pam_message **msg,
20872088
{
20882089
/*
20892090
* Client didn't want to send password. We
2090-
* intentionally do not log anything about this.
2091+
* intentionally do not log anything about this,
2092+
* either here or at higher levels.
20912093
*/
2094+
pam_no_password= true;
20922095
gotofail;
20932096
}
20942097
}
@@ -2147,6 +2150,7 @@ CheckPAMAuth(Port *port, const char *user, const char *password)
21472150
*/
21482151
pam_passwd=password;
21492152
pam_port_cludge=port;
2153+
pam_no_password= false;
21502154

21512155
/*
21522156
* Set the application data portion of the conversation struct. This is
@@ -2232,22 +2236,26 @@ CheckPAMAuth(Port *port, const char *user, const char *password)
22322236

22332237
if (retval!=PAM_SUCCESS)
22342238
{
2235-
ereport(LOG,
2236-
(errmsg("pam_authenticate failed: %s",
2237-
pam_strerror(pamh,retval))));
2239+
/* If pam_passwd_conv_proc saw EOF, don't log anything */
2240+
if (!pam_no_password)
2241+
ereport(LOG,
2242+
(errmsg("pam_authenticate failed: %s",
2243+
pam_strerror(pamh,retval))));
22382244
pam_passwd=NULL;/* Unset pam_passwd */
2239-
returnSTATUS_ERROR;
2245+
returnpam_no_password ?STATUS_EOF :STATUS_ERROR;
22402246
}
22412247

22422248
retval=pam_acct_mgmt(pamh,0);
22432249

22442250
if (retval!=PAM_SUCCESS)
22452251
{
2246-
ereport(LOG,
2247-
(errmsg("pam_acct_mgmt failed: %s",
2248-
pam_strerror(pamh,retval))));
2252+
/* If pam_passwd_conv_proc saw EOF, don't log anything */
2253+
if (!pam_no_password)
2254+
ereport(LOG,
2255+
(errmsg("pam_acct_mgmt failed: %s",
2256+
pam_strerror(pamh,retval))));
22492257
pam_passwd=NULL;/* Unset pam_passwd */
2250-
returnSTATUS_ERROR;
2258+
returnpam_no_password ?STATUS_EOF :STATUS_ERROR;
22512259
}
22522260

22532261
retval=pam_end(pamh,retval);

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp