perfSONAR User Q&A and Other Discussion

[Mark Feit <>]

Bockjoo Kim writes:

 

Our research computing thinks requiring md5 auth is better than using 'peer' for local connections and 'ident' for host connections from localhost/localhost6 (for database users that aren't esmond or pscheduler - stock perfsonar config already required md5 for them).

Why is md5 auth not supported by perfsonar?

Better isn’t better if it breaks something when there’s no security risk.

Local/peer uses the kernel to identify the account at the other end of a local (Unix socket) connection.  Disabling that will prevent the postgres account from having unfettered access to the database, which in turn will break anything that depends on it (pScheduler upgrades, at a minimum).  There’s no security problem with this because that account already owns the server processes and all of the data files and there aren’t roles or grants for other accounts on the system.  You could, in theory, lock it down a bit further by restricting that just to the postgres account, but there’s not a lot of point in it since you pretty much have to trust the kernel.

Host/ident authentication for localhost and localhost6 attempts to use the ident protocol, which the toolkit doesn’t run and almost nobody else does, either.  The PostgreSQL-provided program that initializes the database sets up local authentication.  The default is trust, and the RPMs that PGDG supplies for EL7 set it up for ident.  Those entries could actually be remove entirely; I did that on a test bed host and everything still seems happy.

--Mark