1berry/postgres
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Document that null ciphers are not recommended.

Browse Source 
Mark Mielke
This commit is contained in:
Bruce Momjian 2007-12-29 04:27:02 +00:00
parent ea63bf6ac8
commit c887ae42c1
1 changed files with 13 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
doc/src/sgml/runtime.sgml
View File

@ -1,4 +1,4 @@
<!-- $PostgreSQL: pgsql/doc/src/sgml/runtime.sgml,v 1.399 2007/12/29 03:44:34 momjian Exp $ --> <!-- $PostgreSQL: pgsql/doc/src/sgml/runtime.sgml,v 1.400 2007/12/29 04:27:02 momjian Exp $ -->
<chapter Id="runtime"> <chapter Id="runtime">
<title>Operating System Environment</title> <title>Operating System Environment</title>
@ -1604,12 +1604,20 @@ $ <userinput>kill -INT `head -1 /usr/local/pgsql/data/postmaster.pid`</userinput
ciphers can be specified in the <productname>OpenSSL</productname> ciphers can be specified in the <productname>OpenSSL</productname>
configuration file, you can specify ciphers specifically for use by configuration file, you can specify ciphers specifically for use by
the database server by modifying <xref linkend="guc-ssl-ciphers"> in the database server by modifying <xref linkend="guc-ssl-ciphers"> in
<filename>postgresql .conf</>. It is possible to have authentication <filename>postgresql .conf</>.
without the overhead of encryption by using <literal>NULL-SHA</> or
<literal>NULL-MD5</> ciphers. However, a man-in-the-middle could read
and pass communications between client and server.
</para> </para>
<note>
<para>
It is possible to have authentication without encryption overhead by
using <literal>NULL-SHA</> or <literal>NULL-MD5</> ciphers. However,
a man-in-the-middle could read and pass communications between client
and server. Also, encryption overhead is minimal compared to the
overhead of authentication. For these reasons NULL ciphers are not
recommended.
</para>
</note>
<para> <para>
To start in <acronym>SSL</> mode, the files <filename>server.crt</> To start in <acronym>SSL</> mode, the files <filename>server.crt</>
and <filename>server.key</> must exist in the server's data directory. and <filename>server.key</> must exist in the server's data directory.