Greetings, * Tom Lane (t...@sss.pgh.pa.us) wrote: > Stephen Frost <sfr...@snowman.net> writes: > > ... Definitely a +1 from me, but I'd like us to be thinking about the other > > things we should be doing in this area to bring our password-based > > authentication mechanism kicking-and-screaming into the current decade. > > I'm not really excited about reinventing the whole of PAM, which is > where this argument seems to be leading.
PAM isn't supported on all of our platforms and, really, even where we do support it, it's frankly beyond impractical to actually use the PAM modules because they expect to be run as root, which we don't do. I can understand that you're not excited about it, and I'm not keen to reinvent all of PAM (there's an awful lot of it which we really don't need), but there are features that happen to also exist in PAM (and Kerberos, and LDAP, and RADIUS, and...) that we really should have in our own password-based authentication system because our users are expecting them. Looking at the various forks of PG that are out there shows that quite clearly, I don't imagine they implemented these features out of pure fun, and they obviously also realized that trying to actually use PAM from PG was ultimately a bad idea. Thanks! Stephen
signature.asc
Description: PGP signature