Re: Spoofing as the postmaster

Peter Eisentraut <peter_e@gmx.net> writes:
> Wouldn't SSL work over Unix-domain sockets as well?  The API only deals with 
> file descriptors.

Hmm ... we've always thought of SSL as being primarily comm security
and thus useless on a Unix socket, but the mutual authentication aspect
could come in handy as an answer for this type of threat.  Anyone want
to try this and see if it really works or not?

Does OpenSSL have a mode where it only does mutual auth and not
encryption?  The encryption would be wasted cycles in this scenario,
so being able to turn it off would be nice.
        regards, tom lane