Commit2b4ae9c

committed

doc: requirepeer is a way to avoid spoofing

1 parent0d5afd3 commit2b4ae9cCopy full SHA for 2b4ae9c

File tree

-1

lines changed

-1

lines changed

Lines changed: 8 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -1913,7 +1913,7 @@ pg_dumpall -p 5432 \| psql -d postgres -p 5433`
`1913`	`1913`	`</para>`
`1914`	`1914`
`1915`	`1915`	`<para>`
`1916`		`-The simplestway to prevent spoofingfor <literal>local</>`
	`1916`	`+Onway to prevent spoofingof <literal>local</>`
`1917`	`1917`	`connections is to use a Unix domain socket directory (<xref`
`1918`	`1918`	`linkend="guc-unix-socket-directories">) that has write permission only`
`1919`	`1919`	`for a trusted local user. This prevents a malicious user from creating`
`@@ -1925,6 +1925,13 @@ pg_dumpall -p 5432 \| psql -d postgres -p 5433`
`1925`	`1925`	`<filename>/tmp</> cleanup script to prevent removal of the symbolic link.`
`1926`	`1926`	`</para>`
`1927`	`1927`
	`1928`	`+ <para>`
	`1929`	`+ Another option for <literal>local</> connections is for clients to use`
	`1930`	`+ <link linkend="libpq-connect-requirepeer"><literal>requirepeer</></>`
	`1931`	`+ to specify the required owner of the server process connected to`
	`1932`	`+ the socket.`
	`1933`	`+ </para>`
	`1934`	`+`
`1928`	`1935`	`<para>`
`1929`	`1936`	`To prevent spoofing on TCP connections, the best solution is to use`
`1930`	`1937`	`SSL certificates and make sure that clients check the server's certificate.`

Comments

(0)