Is it really such a good idea to have "trust" authentication enabled for
localhost (TCP/IP and Unix sockets) by default? Since this pretty much
means that anybody with shell access on the server (which depending on
the situation can be only dba people, or a whole lot of other people as
well) can do anything they want with the database, regardless of
permissions?

In some situations this is certainly safe (say a dedicated db server
which only trusted dba:s have access to). In others it's very definitly
not (say a shared hosting machine with hundreds of users). And even in
the first case, it provides a really simple way to get around any
auditing that is set up.

Wouldn't it be safer if you had to explicitly ask for this level if you
really know what you're doing, and default to using password auth (and
then probably have initdb require a superuser password to be specified)?


//Magnus


Mon, 12 Jul 2004 21:41:16 +0200
"Magnus Hagander" <mha@sollentuna.net>
Is "trust" really a good default?
"Magnus Hagander" <mha@sollentuna.net> writes:
> Is it really such a good idea to have "trust" authentication enabled for
> localhost (TCP/IP and Unix sockets) by default?

No, but none of the others are better.  See previous discussions in the
archives.  I don't think the situation has changed any since the last
time we hashed this out.

			regards, tom lane

Mon, 12 Jul 2004 16:07:04 -0400
Tom Lane <tgl@sss.pgh.pa.us>
Re: Is "trust" really a good default? 
Tom Lane wrote:
> "Magnus Hagander" <mha@sollentuna.net> writes:
> > Is it really such a good idea to have "trust" authentication enabled for
> > localhost (TCP/IP and Unix sockets) by default?
> 
> No, but none of the others are better.  See previous discussions in the
> archives.  I don't think the situation has changed any since the last
> time we hashed this out.

If they supply a password to initdb, shouldn't we then require a
password in pg_hba.conf.

-- 
  Bruce Momjian                        |  http://candle.pha.pa.us
  pgman@candle.pha.pa.us               |  (610) 359-1001
  +  If your life is a hard drive,     |  13 Roberts Road
  +  Christ can be your backup.        |  Newtown Square, Pennsylvania 19073

Mon, 12 Jul 2004 16:11:42 -0400 (EDT)
Bruce Momjian <pgman@candle.pha.pa.us>
Re: Is "trust" really a good default?
Bruce Momjian <pgman@candle.pha.pa.us> writes:
> If they supply a password to initdb, shouldn't we then require a
> password in pg_hba.conf.

We could, but I'm a bit disturbed about the issues of documenting two
fundamentally different out-of-the-box behaviors.  The ensuing confusion
might be worse than the existing problem.  (For instance, I can see
people expecting that if they assign the superuser a password later,
they should magically arrive at the same security state as if they'd
done it at initdb time.)

We'd also have some issues with the distributions that override the
default local auth method to be IDENT --- how would this interact
with that choice?  (Note that the RPMs have completely failed to
document this change, which doesn't make me any happier.)

The bottom line to my mind is that if there were a one-size-fits-all
authentication solution, we'd not have so many to choose from.  I don't
think we are doing DBAs any service by pretending that they might not
need to think about their choice of auth method.  I could make a good
case that the initial entry ought to be REJECT, so that you get nothing
at all until you've adjusted pg_hba.conf ...

			regards, tom lane

Mon, 12 Jul 2004 16:43:46 -0400
Tom Lane <tgl@sss.pgh.pa.us>
Re: Is "trust" really a good default? 
> No, but none of the others are better.  See previous discussions in the
> archives.  I don't think the situation has changed any since the last
> time we hashed this out.

I'll chime in from the phpPgAdmin point of view.  The thing with 
phpPgAdmin is that it breaks the 'localhost' access is safe rule that 
the existing trust stuff assumes.  This is because the most common setup 
is Apache and PostgreSQL on the same machine.

The situation got SO BAD with being able to just Google for 'phpPgAdmin 
Login' and then just log straight in as 'pgsql' and no password that 
since version 3.2 or so we have had "extra login security".  That means 
that by default in phpPgAdmin we disallow any login as the 'pgsql', 
'postgres', 'root', or 'administrator' users, and you cannot log into 
any account without a password.

This has fixed the problem greatly, however we get heaps of people who 
cannot understand why they cannot log in.  Those are the people we save 
from themselves.

I think that pg_hba.conf should have md5 on all by default, and the -W 
initdb parameter should be required.

Chris

Tue, 13 Jul 2004 09:45:23 +0800
Christopher Kings-Lynne <chriskl@familyhealth.com.au>
Re: Is "trust" really a good default?
>>No, but none of the others are better.  See previous discussions in the
>>archives.  I don't think the situation has changed any since the last
>>time we hashed this out.
> 
> If they supply a password to initdb, shouldn't we then require a
> password in pg_hba.conf.

This is further to my previous suggestion that we output the encoding 
that is being defaulted to.

NEW USERS DO NOT KNOW THAT -W EXISTS!

Even the majority of experienced users don't!

It's a real pain in the butt that stuff like -E and -W aren't required 
parameters to initdb.

Chris


Tue, 13 Jul 2004 09:46:42 +0800
Christopher Kings-Lynne <chriskl@familyhealth.com.au>
Re: Is "trust" really a good default?