> Magnus Hagander wrote:
> > > not to mention the
> > >more basic problem that the comments will now be wrong.
> > 
> > That, however, it is correct :-( Sloppy.
> > 
> > How about a text along the line of:
> > CAUTION: Configuring the system for "trust" authentication 
> allows any 
> > local user to connect using any PostgreSQL user name, including the 
> > superuser, over either Unix domain sockets or TCP/IP. If 
> you are on a 
> > multiple-user machine, this is probably not good. Change it to use 
> > something other than "trust" authentication.
> > 
> > 
> > 
> > Or something along that line? Since it would no longer actually be 
> > default. Or do we want something like "On some installations, the 
> > default is..."?
> 
> Woh, I didn't think we agreed that the default would change 
> from 'trust', only that we would now emit a warning and allow 
> other authentication methods to be specified at initdb time.

Certainly, I'm not saying it shuold change (I've given that up by now).
But the difference would be that if you used -W with initdb, it would
change the default *for that installation*. Initdb-with-no-parameters
would stay the same to keep people who don't know about the switches
happier.

//Magnus


Wed, 14 Jul 2004 09:56:23 +0200
"Magnus Hagander" <mha@sollentuna.net>
Re: Is "trust" really a good default?
Magnus Hagander wrote:
> Certainly, I'm not saying it shuold change (I've given that up by
> now). But the difference would be that if you used -W with initdb, it
> would change the default *for that installation*.
> Initdb-with-no-parameters would stay the same to keep people who
> don't know about the switches happier.

The fallacy with this line of thought is that it assumes that one 
authentication scheme applies to all ways of connecting.  Often, the 
postgres account is not password protected for local access, for the 
benefit of autovacuum and that sort of maintenance.  Still I might like 
passwords for remote access.  The bottom line is, the user has to 
figure this out himself.

-- 
Peter Eisentraut
http://developer.postgresql.org/~petere/


Thu, 15 Jul 2004 23:17:47 +0200
Peter Eisentraut <peter_e@gmx.net>
Re: Is "trust" really a good default?
Peter Eisentraut <peter_e@gmx.net> writes:
> Magnus Hagander wrote:
>> Certainly, I'm not saying it shuold change (I've given that up by
>> now). But the difference would be that if you used -W with initdb, it
>> would change the default *for that installation*.

> The fallacy with this line of thought is that it assumes that one 
> authentication scheme applies to all ways of connecting.

I think Magnus misspoke by saying that the "default" auth method would
change; there is no default really, and should not be.  What he was
proposing was that the initial contents of pg_hba.conf should specify
password rather than trust authentication for local access.  This does
not imply anything about non-local access rules, since there are none
in the initial pg_hba.conf file.

I don't really see a problem with doing it that way.  People who want to
use -W are presumably worried about the security of their local system,
otherwise they would just fire up the postmaster and set a password
later.  So it seems reasonable to assume that they want password auth
on local connections and go ahead and set up the initial state of
pg_hba.conf to do that.  (If that isn't what they wanted, they can just
edit pg_hba.conf; they're not any worse off than before.)

There are of course some questions about how to document this
effectively, so that it doesn't create more confusion than it avoids.
But in principle it sounds like reasonable behavior to me.

			regards, tom lane

Thu, 15 Jul 2004 17:41:33 -0400
Tom Lane <tgl@sss.pgh.pa.us>
Re: Is "trust" really a good default? 
Tom Lane wrote:
> I don't really see a problem with doing it that way.  People who want
> to use -W are presumably worried about the security of their local
> system, otherwise they would just fire up the postmaster and set a
> password later.

No, that is exactly what I don't agree with.  People might want to 
assign a password just so that the user has one, with the intention of 
configuring non-local password-protected access right after initdb 
finishes.  It's a convenience that you set the password when the user 
is logically created.

> There are of course some questions about how to document this
> effectively, so that it doesn't create more confusion than it avoids.

Yes, that is another thing I'm afraid of.

-- 
Peter Eisentraut
http://developer.postgresql.org/~petere/


Thu, 15 Jul 2004 23:48:34 +0200
Peter Eisentraut <peter_e@gmx.net>
Re: Is "trust" really a good default?
Peter Eisentraut <peter_e@gmx.net> writes:
> Tom Lane wrote:
>> There are of course some questions about how to document this
>> effectively, so that it doesn't create more confusion than it avoids.

> Yes, that is another thing I'm afraid of.

Yeah, if you look up-thread you'll find me expressing the same concern
several days ago.  But this doesn't seem to me to be a reason to reject
the idea outright.  Let's ask for a proposed patch that covers all the
needed documentation changes, and see if it seems clear enough or not.

I still think that the presence of -W/--pwfile in initdb's arguments
is a pretty clear cue that TRUST auth isn't what the DBA intends to
use.  Yes, there will be exceptions, but there will be far more
cases where the TRUST default is wrong even though no -W was given.
So I think we might as well try to do the "right thing" here.  I see
no good argument against it except for the potential-confusion one;
let's see if the proponents can refute that argument by providing
clear documentation.

			regards, tom lane

Thu, 15 Jul 2004 23:27:38 -0400
Tom Lane <tgl@sss.pgh.pa.us>
Re: Is "trust" really a good default? 