Unix Technical Forum

Security of ODBC debug log file leaves something to be desired

This is a discussion on Security of ODBC debug log file leaves something to be desired within the pgsql Interfaces odbc forums, part of the PostgreSQL category; --> What psqlodbc versions RedHat uses? At least there are three Enterprise versions: - Red Hat ES 2 - Red ...


Go Back   Unix Technical Forum > Database Server Software > PostgreSQL > pgsql Interfaces odbc

Register FAQ Members List Calendar Search Today's Posts Mark Forums Read
  #1 (permalink)  
Old 04-16-2008, 01:08 AM
Marko Ristola
 
Posts: n/a
Default Security of ODBC debug log file leaves something to be desired



What psqlodbc versions RedHat uses?

At least there are three Enterprise versions:
- Red Hat ES 2
- Red Hat ES 3
- Red Hat ES 4

I know, that ES 2 and ES 3 use different psqlodbc versions.
I don't know about ES 4.
Which ODBC revisions they are in psqlodbc PostgreSQL CVS?
Each of them might need a different fix.

I don't know, wether I can fix those versions myself.
Here is an attached bugfix for the CVS HEAD.

---------------------------------------

I wrote and attached a fix for the following things
for the CVS HEAD branch (see the attached patch):
1. File permissions; chmod go-rwx for the log file: fixed in this patch.
SVr4, SVID, POSIX, X/OPEN, BSD 4.3 for umask()

2. Pipe redirection problem: fixed in this patch.
SVr4, SVID, POSIX, X/OPEN, BSD 4.3 for fd=open()
IEEE Std1003.1-1988 (POSIX.1) for fdopen().

These are not touched in the patch:
3. Log files are easy to guess: not fixed, because the whole idea of
logging is easy guessability.
Maybe the log directory could be changed?
4. Plaintext passwords are not accepted in log files: CVS HEAD is
already OK.

These fixes work with Debian Sarge, compiled by myself.
I do know, that these fixes do not compile directly with Windows XP:
XP needs at least #include <io.h> and open -> _open and fdopen -> _fdopen
and so forth.
I hope, that they compile with many architectures because of the POSIX
compatibility.

I fixed the pipe redirection problem by forcing the creation of the log
file.
If the log file exists already, no logging is done.
It prints an error message into stderr (only once).
So it can't be a pipe or a soft link! This problem remains with NFS:
open() with O_EXCL does not work properly with NFS (see man 2 open).

Marko Ristola



---------------------------(end of broadcast)---------------------------
TIP 3: if posting/reading through Usenet, please send an appropriate
subscribe-nomail command to majordomo@postgresql.org so that your
message can get through to the mailing list cleanly

Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On
Forum Jump


All times are GMT. The time now is 08:41 AM.


Powered by vBulletin® Version 3.6.5
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
SEO by vBSEO 3.2.0
www.UnixAdminTalk.com