Skip to content

Commit 996832c

Browse files
peterepetere
committed
Make the location of the Kerberos server key file run time configurable
(rather than compile time). For libpq, even when Kerberos support is compiled in, the default user name should still fall back to geteuid() if it can't be determined via the Kerberos system. A couple of fixes for string type configuration parameters, now that there is one.
1 parent 69cf335 commit 996832c

File tree

11 files changed

+491
-515
lines changed

11 files changed

+491
-515
lines changed

‎configure

Lines changed: 398 additions & 413 deletions
Large diffs are not rendered by default.

‎configure.in

Lines changed: 6 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -477,6 +477,8 @@ if test "$with_krb4" = yes ; then
477477
fi
478478
dnl Test for these libraries is below
479479
KRB_LIBS="$krb_libdir -lkrb -ldes"
480+
481+
krb_srvtab='/etc/srvtab'
480482
fi
481483

482484

@@ -513,6 +515,8 @@ if test "$with_krb5" = yes ; then
513515

514516
dnl Test for these libraries is below
515517
KRB_LIBS="$krb_libdir -lkrb5 -lcrypto -lcom_err"
518+
519+
krb_srvtab='FILE:$(sysconfdir)/krb5.keytab'
516520
fi
517521

518522

@@ -521,6 +525,8 @@ if test "$with_krb4" = yes && test "$with_krb5" = yes ; then
521525
AC_MSG_ERROR([Kerberos 4 and Kerberos 5 support cannot be combined])
522526
fi
523527

528+
529+
AC_SUBST(krb_srvtab)
524530
dnl Necessary for special libpq link
525531
AC_SUBST(KRB_LIBS)
526532

@@ -537,20 +543,6 @@ fi],
537543
[krb_srvnam="postgres"])
538544
AC_DEFINE_UNQUOTED(PG_KRB_SRVNAM, ["$krb_srvnam"], [The name of the Postgres service principal])
539545

540-
AC_ARG_WITH(krb-srvtab, [ --with-krb-srvtab=FILE location of Kerberos server's keytab file],
541-
[if test x"$withval" = x"yes"; then
542-
AC_MSG_ERROR([argument required for --with-krb-srvtab])
543-
else
544-
krb_srvtab=$withval
545-
fi],
546-
[if test "$with_krb5" = yes ; then
547-
krb_srvtab='FILE:${sysconfdir}/krb5.keytab'
548-
elif test "$with_krb4" = yes ; then
549-
krb_srvtab='/etc/srvtab'
550-
else
551-
krb_srvtab=
552-
fi])
553-
AC_SUBST(krb_srvtab)
554546

555547

556548
#

‎doc/src/sgml/client-auth.sgml

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<!-- $Header: /cvsroot/pgsql/doc/src/sgml/client-auth.sgml,v 1.3 2000/07/15 21:35:47 petere Exp $ -->
1+
<!-- $Header: /cvsroot/pgsql/doc/src/sgml/client-auth.sgml,v 1.4 2000/08/25 10:00:29 petere Exp $ -->
22

33
<chapter id="client-authentication">
44
<title>Client Authentication</title>
@@ -341,7 +341,7 @@ host all 192.168.2.0 255.255.255.0 ident othermap
341341

342342
</sect2>
343343

344-
<sect2>
344+
<sect2 id="kerberos-auth">
345345
<title>Kerberos authentication</title>
346346

347347
<para>
@@ -369,13 +369,15 @@ host all 192.168.2.0 255.255.255.0 ident othermap
369369
<productname>Postgres</> should operate like a normal Kerberos
370370
service. The name of the service principal is normally
371371
<literal>postgres</literal>, unless it was changed during the
372-
build. Make sure that your server keytab file is readable (and
372+
build. Make sure that your server key file is readable (and
373373
preferrably only readable) by the Postgres server account (see
374-
<xref linkend="postgres-user">). The location of the keytab file
375-
is specified at build time; by default it is
376-
<filename>/etc/srvtab</filename> in Kerberos 4 and
377-
<filename>FILE:/usr/local/pgsql/etc/krb5.keytab</filename> in
378-
Kerberos 5.
374+
<xref linkend="postgres-user">). The location of the key file
375+
is specified with the <varname>krb_server_keyfile</> run time
376+
configuration parameter. (See also <xref linkend="runtime-config">.)
377+
The default is <filename>/etc/srvtab</> if you are using Kerberos 4
378+
and <filename>FILE:/usr/local/pgsql/etc/krb5.keytab</> (or whichever
379+
directory was specified as <varname>sysconfdir</> at build time)
380+
with Kerberos 5.
379381
</para>
380382

381383
<para>

‎doc/src/sgml/installation.sgml

Lines changed: 2 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<!-- $Header: /cvsroot/pgsql/doc/src/sgml/installation.sgml,v 1.13 2000/07/22 14:48:01 petere Exp $ -->
1+
<!-- $Header: /cvsroot/pgsql/doc/src/sgml/installation.sgml,v 1.14 2000/08/25 10:00:29 petere Exp $ -->
22

33
<chapter id="installation">
44
<title><![%flattext-install-include[<productname>PostgreSQL</> ]]>Installation Instructions</title>
@@ -577,27 +577,13 @@ su - postgres
577577
</listitem>
578578
</varlistentry>
579579

580-
<varlistentry>
581-
<term>--with-krb-srvtab=<replaceable>FILE</></term>
582-
<listitem>
583-
<para>
584-
Specifies the location of the Kerberos server shared key file
585-
(<quote>srvtab</>). If you are using Kerberos 4, this
586-
defaults to <filename>/etc/srvtab</>, with Kerberos 5 to
587-
<filename>FILE:/usr/local/pgsql/etc/krb5.keytab</>, or
588-
equivalent, depending on what you set <option>--sysconfdir</>
589-
to above.
590-
</para>
591-
</listitem>
592-
</varlistentry>
593-
594580
<varlistentry>
595581
<term>--enable-syslog</term>
596582
<listitem>
597583
<para>
598584
Enables the <productname>PostgreSQL</> server to use the
599585
syslog logging facility. (Using this option does not mean
600-
that you have to log with syslog or even that it will be done
586+
that you will have to log with syslog or even that it will be done
601587
by default, it simply makes it possible to turn this option
602588
on at run time.)
603589
</para>

‎doc/src/sgml/runtime.sgml

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<!--
2-
$Header: /cvsroot/pgsql/doc/src/sgml/runtime.sgml,v 1.18 2000/08/11 18:31:06 tgl Exp $
2+
$Header: /cvsroot/pgsql/doc/src/sgml/runtime.sgml,v 1.19 2000/08/25 10:00:29 petere Exp $
33
-->
44

55
<Chapter Id="runtime">
@@ -898,6 +898,16 @@ env PGOPTIONS='--geqo=off' psql
898898
</listitem>
899899
</varlistentry>
900900

901+
<varlistentry>
902+
<term>KRB_SERVER_KEYFILE</>
903+
<listitem>
904+
<para>
905+
Sets the location of the Kerberos server key file. See
906+
<xref linkend="kerberos-auth"> for details.
907+
</para>
908+
</listitem>
909+
</varlistentry>
910+
901911
<varlistentry>
902912
<term>MAX_CONNECTIONS (<type>integer</type>)</term>
903913
<listitem>

‎src/backend/libpq/Makefile

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4,26 +4,20 @@
44
# Makefile for libpq subsystem (backend half of libpq interface)
55
#
66
# IDENTIFICATION
7-
# $Header: /cvsroot/pgsql/src/backend/libpq/Makefile,v 1.23 2000/07/09 13:48:45 petere Exp $
7+
# $Header: /cvsroot/pgsql/src/backend/libpq/Makefile,v 1.24 2000/08/25 10:00:30 petere Exp $
88
#
99
#-------------------------------------------------------------------------
1010

1111
subdir = src/backend/libpq
1212
top_builddir = ../../..
13-
include ../../Makefile.global
13+
include $(top_builddir)/src/Makefile.global
1414

1515
# be-fsstubs is here for historical reasons, probably belongs elsewhere
1616

1717
OBJS = be-fsstubs.o \
1818
auth.o crypt.o hba.o password.o \
1919
pqcomm.o pqformat.o pqpacket.o pqsignal.o util.o
2020

21-
# This location might depend on the installation directories. Therefore
22-
# we can't subsitute it into config.h.
23-
ifdef krb_srvtab
24-
CPPFLAGS += -DPG_KRB_SRVTAB='"$(krb_srvtab)"'
25-
endif
26-
2721

2822
all: SUBSYS.o
2923

@@ -39,4 +33,3 @@ clean:
3933
ifeq (depend,$(wildcard depend))
4034
include depend
4135
endif
42-

‎src/backend/libpq/auth.c

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
*
99
*
1010
* IDENTIFICATION
11-
* $Header: /cvsroot/pgsql/src/backend/libpq/auth.c,v 1.48 2000/07/04 16:31:53 petere Exp $
11+
* $Header: /cvsroot/pgsql/src/backend/libpq/auth.c,v 1.49 2000/08/25 10:00:30 petere Exp $
1212
*
1313
*-------------------------------------------------------------------------
1414
*/
@@ -51,6 +51,9 @@ static int map_old_to_new(Port *port, UserAuth old, int status);
5151
static void auth_failed(Port *port);
5252

5353

54+
char * pg_krb_server_keyfile;
55+
56+
5457
#ifdef KRB4
5558
/*----------------------------------------------------------------
5659
* MIT Kerberos authentication system - protocol version 4
@@ -89,7 +92,7 @@ pg_krb4_recvauth(Port *port)
8992
&port->raddr.in,
9093
&port->laddr.in,
9194
&auth_data,
92-
PG_KRB_SRVTAB,
95+
pg_krb_server_keyfile,
9396
key_sched,
9497
version);
9598
if (status != KSUCCESS)
@@ -197,13 +200,13 @@ pg_krb5_init(void)
197200
return STATUS_ERROR;
198201
}
199202

200-
retval = krb5_kt_resolve(pg_krb5_context, PG_KRB_SRVTAB, &pg_krb5_keytab);
203+
retval = krb5_kt_resolve(pg_krb5_context, pg_krb_server_keyfile, &pg_krb5_keytab);
201204
if (retval) {
202205
snprintf(PQerrormsg, PQERRORMSG_LENGTH,
203206
"pg_krb5_init: krb5_kt_resolve returned"
204207
" Kerberos error %d\n", retval);
205208
com_err("postgres", retval, "while resolving keytab file %s",
206-
PG_KRB_SRVTAB);
209+
pg_krb_server_keyfile);
207210
krb5_free_context(pg_krb5_context);
208211
return STATUS_ERROR;
209212
}
@@ -216,7 +219,7 @@ pg_krb5_init(void)
216219
" Kerberos error %d\n", retval);
217220
com_err("postgres", retval,
218221
"while getting server principal for service %s",
219-
PG_KRB_SRVTAB);
222+
pg_krb_server_keyfile);
220223
krb5_kt_close(pg_krb5_context, pg_krb5_keytab);
221224
krb5_free_context(pg_krb5_context);
222225
return STATUS_ERROR;

‎src/backend/utils/misc/Makefile

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
1-
#-------------------------------------------------------------------------
2-
#
3-
# Makefile--
4-
# Makefile for utils/misc
5-
#
6-
# IDENTIFICATION
7-
# $Header: /cvsroot/pgsql/src/backend/utils/misc/Makefile,v 1.16 2000/06/04 01:44:34 petere Exp $
8-
#
9-
#-------------------------------------------------------------------------
10-
11-
SRCDIR = ../../..
12-
include $(SRCDIR)/Makefile.global
1+
# $Header: /cvsroot/pgsql/src/backend/utils/misc/Makefile,v 1.17 2000/08/25 10:00:31 petere Exp $
2+
3+
subdir = src/backend/utils/misc
4+
top_builddir = ../../../..
5+
include $(top_builddir)/src/Makefile.global
136

147
OBJS = database.o superuser.o guc.o guc-file.o ps_status.o
158

9+
# This location might depend on the installation directories. Therefore
10+
# we can't subsitute it into config.h.
11+
ifdef krb_srvtab
12+
CPPFLAGS += -DPG_KRB_SRVTAB='"$(krb_srvtab)"'
13+
endif
14+
15+
1616
all: SUBSYS.o
1717

1818
SUBSYS.o: $(OBJS)

‎src/backend/utils/misc/guc.c

Lines changed: 18 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
* Support for grand unified configuration scheme, including SET
55
* command, configuration file, and command line options.
66
*
7-
* $Header: /cvsroot/pgsql/src/backend/utils/misc/guc.c,v 1.8 2000/08/11 18:31:10 tgl Exp $
7+
* $Header: /cvsroot/pgsql/src/backend/utils/misc/guc.c,v 1.9 2000/08/25 10:00:31 petere Exp $
88
*
99
* Copyright 2000 by PostgreSQL Global Development Group
1010
* Written by Peter Eisentraut <peter_e@gmx.net>.
@@ -21,6 +21,7 @@
2121
#include "utils/guc.h"
2222

2323
#include "commands/async.h"
24+
#include "libpq/auth.h"
2425
#include "miscadmin.h"
2526
#include "optimizer/cost.h"
2627
#include "optimizer/geqo.h"
@@ -54,6 +55,11 @@ bool Show_btree_build_stats = false;
5455

5556
bool SQL_inheritance = true;
5657

58+
#ifndef PG_KRB_SRVTAB
59+
# define PG_KRB_SRVTAB ""
60+
#endif
61+
62+
5763

5864
enum config_type
5965
{
@@ -113,7 +119,7 @@ struct config_string
113119
{
114120
const char *name;
115121
GucContext context;
116-
char *variable;
122+
char **variable;
117123
const char *default_val;
118124
bool (*parse_hook)(const char *);
119125
};
@@ -273,7 +279,8 @@ ConfigureNamesReal[] =
273279
static struct config_string
274280
ConfigureNamesString[] =
275281
{
276-
/* none so far */
282+
{"krb_server_keyfile", PGC_USERSET, &pg_krb_server_keyfile,
283+
PG_KRB_SRVTAB, NULL},
277284

278285
{NULL, 0, NULL, NULL, NULL}
279286
};
@@ -323,7 +330,7 @@ find_option(const char * name, struct config_generic ** record)
323330
{
324331
if (record)
325332
*record = (struct config_generic *)&ConfigureNamesString[i];
326-
return PGC_REAL;
333+
return PGC_STRING;
327334
}
328335

329336
return PGC_NONE;
@@ -349,7 +356,7 @@ ResetAllOptions(void)
349356
for (i = 0; ConfigureNamesReal[i].name; i++)
350357
*(ConfigureNamesReal[i].variable) = ConfigureNamesReal[i].default_val;
351358

352-
for (i = 0; ConfigureNamesString[i].name; i++)
359+
for (i = 0; ConfigureNamesString[i].name; i++)
353360
{
354361
char * str = NULL;
355362

@@ -359,7 +366,7 @@ ResetAllOptions(void)
359366
if (str == NULL)
360367
elog(ERROR, "out of memory");
361368
}
362-
ConfigureNamesString[i].variable = str;
369+
*(ConfigureNamesString[i].variable) = str;
363370
}
364371

365372
if (getenv("PGPORT"))
@@ -650,8 +657,8 @@ set_config_option(const char * name, const char * value, GucContext
650657
elog(elevel, "out of memory");
651658
return false;
652659
}
653-
free(conf->variable);
654-
conf->variable = str;
660+
free(*conf->variable);
661+
*conf->variable = str;
655662
}
656663
}
657664
else if (DoIt)
@@ -664,8 +671,8 @@ set_config_option(const char * name, const char * value, GucContext
664671
elog(elevel, "out of memory");
665672
return false;
666673
}
667-
free(conf->variable);
668-
conf->variable = str;
674+
free(*conf->variable);
675+
*conf->variable = str;
669676
}
670677
break;
671678
}
@@ -725,7 +732,7 @@ GetConfigOption(const char * name)
725732
return buffer;
726733

727734
case PGC_STRING:
728-
return ((struct config_string *)record)->variable;
735+
return *((struct config_string *)record)->variable;
729736

730737
default:
731738
;

‎src/include/libpq/auth.h

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
* Portions Copyright (c) 1996-2000, PostgreSQL, Inc
88
* Portions Copyright (c) 1994, Regents of the University of California
99
*
10-
* $Id: auth.h,v 1.13 2000/01/26 05:58:11 momjian Exp $
10+
* $Id: auth.h,v 1.14 2000/08/25 10:00:33 petere Exp $
1111
*
1212
*-------------------------------------------------------------------------
1313
*/
@@ -26,4 +26,6 @@ void be_recvauth(Port *port);
2626
#define PG_KRB4_VERSION "PGVER4.1" /* at most KRB_SENDAUTH_VLEN chars */
2727
#define PG_KRB5_VERSION "PGVER5.1"
2828

29+
extern char * pg_krb_server_keyfile;
30+
2931
#endif /* AUTH_H */

0 commit comments

Comments
 (0)