diff options
| author | Bruce Momjian <bruce@momjian.us> | 2005-10-24 15:49:54 +0000 |
|---|---|---|
| committer | Bruce Momjian <bruce@momjian.us> | 2005-10-24 15:49:54 +0000 |
| commit | 42b689aed4f33bf0bdfdbdfecb724477c98913d5 (patch) | |
| tree | f1407f23e96044c1034a95d889732311d671bd92 | |
| parent | 24fa8746ae688c1fb2840b65197dfd9cf100c9ed (diff) | |
| download | postgresql-42b689aed4f33bf0bdfdbdfecb724477c98913d5.tar.gz postgresql-42b689aed4f33bf0bdfdbdfecb724477c98913d5.zip | |
More forcefully recommend MD5 over crypt authentication.
| -rw-r--r-- | doc/src/sgml/client-auth.sgml | 15 |
1 files changed, 10 insertions, 5 deletions
diff --git a/doc/src/sgml/client-auth.sgml b/doc/src/sgml/client-auth.sgml index a82b79bd7dd..e4dff02fa81 100644 --- a/doc/src/sgml/client-auth.sgml +++ b/doc/src/sgml/client-auth.sgml @@ -1,5 +1,5 @@ <!-- -$PostgreSQL: pgsql/doc/src/sgml/client-auth.sgml,v 1.84 2005/10/24 15:38:36 momjian Exp $ +$PostgreSQL: pgsql/doc/src/sgml/client-auth.sgml,v 1.85 2005/10/24 15:49:54 momjian Exp $ --> <chapter id="client-authentication"> @@ -319,11 +319,16 @@ hostnossl <replaceable>database</replaceable> <replaceable>user</replaceable> <varlistentry> <term><literal>crypt</></term> <listitem> + <note> + <para> + This option is recommended only for communicating with pre-7.2 + clients. + </para> + </note> <para> Require the client to supply a <function>crypt()</>-encrypted password for authentication. - <literal>md5</literal> is preferred for 7.2 and later clients, - but pre-7.2 clients only support <literal>crypt</>. + <literal>md5</literal> is now recommended over <literal>crypt</>. See <xref linkend="auth-password"> for details. </para> </listitem> @@ -589,8 +594,8 @@ local db1,db2,@demodbs all md5 <para> If you are at all concerned about password <quote>sniffing</> attacks then <literal>md5</> is preferred, with - <literal>crypt</> a second choice if you must support pre-7.2 - clients. Plain <literal>password</> should especially be avoided for + <literal>crypt</> to be used only if you must support pre-7.2 + clients. Plain <literal>password</> should be avoided especially for connections over the open Internet (unless you use <acronym>SSL</acronym>, <acronym>SSH</>, or another communications security wrapper around the connection). |