Re: [tlug] CentOS using default/blank? password postgres

[Curt Sampson <cjs@example.com>]

On 2008-08-22 14:31 +0900 (Fri), Keith Bawden wrote:

> On Fri, Aug 22, 2008 at 12:46, Curt Sampson <cjs@example.com> wrote:
>
> > I disagree. People, no matter how knowledgable, will make errors and
> > omissions from time to time, and any properly set up system should fail
> > safe when this is done.
> 
> A "properly setup system" is something the system itself cannot know
> exactly - after all what you want out of a DB might be different from
> what I want....

Sorry, I didn't clearly state what I meant by "properly set up." I mean
that the installer is not properly written if the default configuration
is not a safe and secure one.

For example, NetBSD, after a default installation will boot up but will
start no network-listening daemons at all. This is safe.

> My point was that something blatantly bogus like running without a
> root password set and without informing the person doing the setup
> that this is the case is a bad thing.

Actually, the issue here was not that there was no root password; the
issue is that the default configuration a) allows root logins over the
network, and b) allows password logins. Both of these should be disabled
by default, because they're both dangerous, and so the user should make
a conscious decision to enable them. It would also be good to have
appropriate warnings in the config files where the setting would be
enabled.

> However, my point is _also_ that it helps if the person doing the
> setup either has a bit of knowledge on the subject....

Sure, it's helpful. But I think we both agree that even the most
knowledgable person will make mistakes once in a while; it's the nature
of humans to do so.

> The system should catch some blatant misconfiguration....

While I agree with that, my actual point was that installs should be
secure by default, with user action required to make them less secure.

cjs
-- 
Curt Sampson       <cjs@example.com>        +81 90 7737 2974   
Mobile sites and software consulting: http://www.starling-software.com