Enable multiple client listeners on TCP with non-TLS modes

[jseldess]

Jesse Seldess commented:

Background: https://airtable.com/tblD3oZPLJgGhCmch/viw1DKmbKhg2MIECH/recgM6Ow1w8Y6ph34

Jira Issue: DOC-379

[jseldess]

@knz, this is the docs issue for the roadmap work to allow passwords in insecure mode. Copying your comment from cockroachdb/cockroach#16188 (comment):

We have a path forward on this now.
Starting with 20.1, CockroachDB supports non-TLS connections via the local unix socket in secure mode and will authenticate using passwords.

This can be exploited to create insecure network listeners with password auth, for example using a TCP-to-unix socket proxy (including plain nc).

[jseldess]

PR: cockroachdb/cockroach#43848

From release notes:

Connections using unix sockets are now accepted even when the server is running in secure mode. Consult cockroach start --help for details about the --socket parameter. [#43848][#43848] {% comment %}doc{% endcomment %}

PR: cockroachdb/cockroach#43848

From release notes:

• Connections using unix sockets are now subject to the HBA rules defined via the setting server.host_based_authentication.configuration, in a way compatible with PostgreSQL: incoming unix connections match local rules, whereas incoming TCP connections match host rules. The default HBA configuration used when the cluster setting is empty is now:

  host      all root all cert
  host      all all  all cert-password     
  local     all all      password
  

  [#43848][#43848]

[knz]

Note that the top issue description is not aligned with the product change. We are not changing the behavior of insecure mode, and the insecure mode will remain insecure.

What is changing is the ability for users to use password authentication over non-TLS (and thus non-encrypted) connections. We did a little of this in 20.1 and more will be coming in 20.2.