Document that null ciphers are not recommended.

Mark Mielke

diff --git a/doc/src/sgml/runtime.sgml b/doc/src/sgml/runtime.sgml
index 81970540edd41db394f11c85a20c338eda36bbe9..af7a7cf06ed601c282f423b1ae79d82bd12cda24 100644 (file)
--- a/doc/src/sgml/runtime.sgml
+++ b/doc/src/sgml/runtime.sgml
@@ -1,4 +1,4 @@
-<!-- $PostgreSQL: pgsql/doc/src/sgml/runtime.sgml,v 1.399 2007/12/29 03:44:34 momjian Exp $ -->
+<!-- $PostgreSQL: pgsql/doc/src/sgml/runtime.sgml,v 1.400 2007/12/29 04:27:02 momjian Exp $ -->
 
 <chapter Id="runtime">
  <title>Operating System Environment</title>
@@ -1604,12 +1604,20 @@ $ <userinput>kill -INT `head -1 /usr/local/pgsql/data/postmaster.pid`</userinput
    ciphers can be specified in the <productname>OpenSSL</productname>
    configuration file, you can specify ciphers specifically for use by
    the database server by modifying <xref linkend="guc-ssl-ciphers"> in
-   <filename>postgresql        .conf</>.  It is possible to have authentication
-   without the overhead of encryption by using <literal>NULL-SHA</> or
-   <literal>NULL-MD5</> ciphers.  However, a man-in-the-middle could read
-   and pass communications between client and server.
+   <filename>postgresql        .conf</>.
   </para>
 
+  <note>
+   <para>
+    It is possible to have authentication without encryption overhead by
+    using <literal>NULL-SHA</> or <literal>NULL-MD5</> ciphers.  However,
+    a man-in-the-middle could read and pass communications between client
+    and server.  Also, encryption overhead is minimal compared to the
+    overhead of authentication.  For these reasons NULL ciphers are not
+    recommended.
+   </para>
+  </note>
+
   <para>
    To start in <acronym>SSL</> mode, the files <filename>server.crt</>
    and <filename>server.key</> must exist in the server's data directory.