From 53a5026b5cb359ec31e81fa6b20a69b053b87569 Mon Sep 17 00:00:00 2001
From: Magnus Hagander <magnus@hagander.net>
Date: Tue, 28 Oct 2008 12:10:44 +0000
Subject: Remove support for (insecure) crypt authentication.

This breaks compatibility with pre-7.2 versions.
---
 doc/src/sgml/client-auth.sgml | 37 +++++--------------------------------
 1 file changed, 5 insertions(+), 32 deletions(-)

(limited to 'doc/src/sgml/client-auth.sgml')

diff --git a/doc/src/sgml/client-auth.sgml b/doc/src/sgml/client-auth.sgml
index 5a308eb895..93482be6ea 100644
--- a/doc/src/sgml/client-auth.sgml
+++ b/doc/src/sgml/client-auth.sgml
@@ -1,4 +1,4 @@
-<!-- $PostgreSQL: pgsql/doc/src/sgml/client-auth.sgml,v 1.109 2008/10/23 13:31:09 mha Exp $ -->
+<!-- $PostgreSQL: pgsql/doc/src/sgml/client-auth.sgml,v 1.110 2008/10/28 12:10:42 mha Exp $ -->
 
 <chapter id="client-authentication">
  <title>Client Authentication</title>
@@ -315,24 +315,6 @@ hostnossl  <replaceable>database</replaceable>  <replaceable>user</replaceable>
         </listitem>
        </varlistentry>
 
-       <varlistentry>
-        <term><literal>crypt</></term>
-        <listitem>
-         <note>
-         <para>
-          This option is recommended only for communicating with pre-7.2
-          clients.
-         </para>
-         </note>
-         <para>
-          Require the client to supply a <function>crypt()</>-encrypted
-          password for authentication.
-          <literal>md5</literal> is now recommended over <literal>crypt</>.
-          See <xref linkend="auth-password"> for details.
-         </para>
-        </listitem>
-       </varlistentry>
-
        <varlistentry>
         <term><literal>password</></term>
         <listitem>
@@ -704,9 +686,6 @@ omicron       bryanh            guest1
    <indexterm>
     <primary>MD5</>
    </indexterm>
-   <indexterm>
-    <primary>crypt</>
-   </indexterm>
    <indexterm>
     <primary>password</primary>
     <secondary>authentication</secondary>
@@ -714,21 +693,15 @@ omicron       bryanh            guest1
 
    <para>
     The password-based authentication methods are <literal>md5</>,
-    <literal>crypt</>, and <literal>password</>. These methods operate
+    and <literal>password</>. These methods operate
     similarly except for the way that the password is sent across the
-    connection: respectively, MD5-hashed, crypt-encrypted, and clear-text.
-    A limitation is that the <literal>crypt</> method does not work with
-    passwords that have been encrypted in <structname>pg_authid</structname>.
+    connection: respectively, MD5-hashed and clear-text.
    </para>
 
    <para>
     If you are at all concerned about password
-    <quote>sniffing</> attacks then <literal>md5</> is preferred, with
-    <literal>crypt</> to be used only if you must support pre-7.2
-    clients. Plain <literal>password</> should be avoided especially for
-    connections over the open Internet (unless you use <acronym>SSL</acronym>,
-    <acronym>SSH</>, or another
-    communications security wrapper around the connection).
+    <quote>sniffing</> attacks then <literal>md5</> is preferred.
+    Plain <literal>password</> should always be avoided if possible.
    </para>
 
    <para>
-- 
cgit v1.2.1