From: Tom Lane <tgl@sss.pgh.pa.us>
To: John Scalia <jayknowsunix@gmail.com>
cc: Venkata B Nagothi <nag1010@gmail.com>,
        pgsql-admin <pgsql-admin@postgresql.org>
Subject: Re: hostnossl in pg_hba.conf demands a password
In-reply-to: <5878107F-B5AB-4AEB-8B52-987AF3DB1739@gmail.com>
References: <BE1F46E9-B06A-4FE4-A2BF-D470E2488CEA@gmail.com>
 <CAEyp7J_Y5sG0MSUyPCFPencprUAVeHEbfH=sv6vpwxtzgkEumQ@mail.gmail.com>
 <5878107F-B5AB-4AEB-8B52-987AF3DB1739@gmail.com>
Comments: In-reply-to John Scalia <jayknowsunix@gmail.com>
	message dated "Mon, 14 Nov 2016 16:23:05 -0500"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <13377.1479160375.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Mon, 14 Nov 2016 16:52:55 -0500
Message-ID: <13378.1479160375@sss.pgh.pa.us>
Precedence: bulk
Sender: pgsql-admin-owner@postgresql.org

John Scalia <jayknowsunix@gmail.com> writes:
> The only entries are a local connection line with md5 authentication spec=
ified and a line for local replication with a trust authentication. Both of=
 these entries do seem to be working properly.

So the client is trying an SSL connection first (which would be the
default behavior for libpq at least), and that falls through the
hostnossl line and is captured by the md5 line.  Hence you get a
password prompt.  The client has no way to know that a non-SSL
connection would have gotten a different response.

You could change the md5 line to hostssl, perhaps.  Or configure
the client to try non-SSL first (see sslprefer).

			regards, tom lane


--=20
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin