diff options
| author | Bruce Momjian <bruce@momjian.us> | 2007-12-29 04:27:02 +0000 |
|---|---|---|
| committer | Bruce Momjian <bruce@momjian.us> | 2007-12-29 04:27:02 +0000 |
| commit | c887ae42c1671c9e4260c9c9afceeadfa71c5b81 (patch) | |
| tree | 53078c07f75ce2fbbecd721bc022073d1f187dda | |
| parent | ea63bf6ac83af97f36e5653fa7d3269958bd067a (diff) | |
| download | postgresql-c887ae42c1671c9e4260c9c9afceeadfa71c5b81.tar.gz postgresql-c887ae42c1671c9e4260c9c9afceeadfa71c5b81.zip | |
Document that null ciphers are not recommended.
Mark Mielke
| -rw-r--r-- | doc/src/sgml/runtime.sgml | 18 |
1 files changed, 13 insertions, 5 deletions
diff --git a/doc/src/sgml/runtime.sgml b/doc/src/sgml/runtime.sgml index 81970540edd..af7a7cf06ed 100644 --- a/doc/src/sgml/runtime.sgml +++ b/doc/src/sgml/runtime.sgml @@ -1,4 +1,4 @@ -<!-- $PostgreSQL: pgsql/doc/src/sgml/runtime.sgml,v 1.399 2007/12/29 03:44:34 momjian Exp $ --> +<!-- $PostgreSQL: pgsql/doc/src/sgml/runtime.sgml,v 1.400 2007/12/29 04:27:02 momjian Exp $ --> <chapter Id="runtime"> <title>Operating System Environment</title> @@ -1604,12 +1604,20 @@ $ <userinput>kill -INT `head -1 /usr/local/pgsql/data/postmaster.pid`</userinput ciphers can be specified in the <productname>OpenSSL</productname> configuration file, you can specify ciphers specifically for use by the database server by modifying <xref linkend="guc-ssl-ciphers"> in - <filename>postgresql .conf</>. It is possible to have authentication - without the overhead of encryption by using <literal>NULL-SHA</> or - <literal>NULL-MD5</> ciphers. However, a man-in-the-middle could read - and pass communications between client and server. + <filename>postgresql .conf</>. </para> + <note> + <para> + It is possible to have authentication without encryption overhead by + using <literal>NULL-SHA</> or <literal>NULL-MD5</> ciphers. However, + a man-in-the-middle could read and pass communications between client + and server. Also, encryption overhead is minimal compared to the + overhead of authentication. For these reasons NULL ciphers are not + recommended. + </para> + </note> + <para> To start in <acronym>SSL</> mode, the files <filename>server.crt</> and <filename>server.key</> must exist in the server's data directory. |