37 lines
1.3 KiB
Markdown
37 lines
1.3 KiB
Markdown
|
[mailing_list](https://www.postgresql.org/message-id/flat/CAHq%2BKHJOvZT8M-o_sE%2BQzqqBGnUjNubWo_rRmpHZyw5ZUuaseg%40mail.gmail.com)
|
|||
|
|
|
|||
|
|
|
|||
|
|
wouldn't that be Pg authing against the OS (pam) which in turn is forwarding to krb5? which seems like an extra added step
|
|||
|
|
|
|||
|
|
sfrost [11:11 AM]
|
|||
|
|
it's basically this:
|
|||
|
|
ktpass -out postgres.keytab -princ
|
|||
|
|
POSTGRES/centos(at)MY(dot)TESTDOMAIN(dot)LAN -mapUser enterprisedb -pass XXXXXX
|
|||
|
|
-crypto DES-CBC-MD5
|
|||
|
|
(except adjusted a bit to make it not use a shitty crypto)
|
|||
|
|
you use ktpass to create your keytab file
|
|||
|
|
copy the keytab file to the Linux box
|
|||
|
|
|
|||
|
|
arossouw [11:12 AM]
|
|||
|
|
Seems like effort, i'll just play dumb on that one
|
|||
|
|
|
|||
|
|
sfrost [11:12 AM]
|
|||
|
|
oh, gotta fix the princ too or whatever
|
|||
|
|
but it's not that hard
|
|||
|
|
and you might have to configure the realms, but not necessairly (that info is often in DNS already)
|
|||
|
|
then you just tell PG where the keytab file is, set gssapi in PG's hba.conf, and create your users using their princ names, like 'sfrost@SNOWMAN.NET'
|
|||
|
|
|
|||
|
|
dtseiler [11:13 AM]
|
|||
|
|
I’m with @hunleyd, I’d love to see a great howto post on that.
|
|||
|
|
|
|||
|
|
arossouw [11:14 AM]
|
|||
|
|
I suppose the question is what is the advantage of using kerberos, and then deciding if its worth spending time on
|
|||
|
|
|
|||
|
|
sfrost [11:14 AM]
|
|||
|
|
I just wrote it
|
|||
|
|
^^^ see above
|
|||
|
|
also wrote the advantage...
|
|||
|
|
|
|||
|
|
|
|||
|
|
hunleyd [11:14 AM]
|
|||
|
|
maybe i'll try this as a 10% project some day
|