pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedTrouble setting up access privileges
3+ messages / 2 participants
[nested] [flat]
* Trouble setting up access privileges
@ 2008-09-15 15:43 mkrist@binf.ku.dk
2008-09-15 17:08 ` Re: Trouble setting up access privileges Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 3+ messages in thread
From: mkrist@binf.ku.dk @ 2008-09-15 15:43 UTC (permalink / raw)
To: pgsql-admin
Hi pgsql-admin mailing list,
I'm having some problems setting up access privileges via pg_hba.conf. The
problem is that it seems that some Linux user accounts have password-less
access to the pgsql databases via the 'pgsql' CLI tool even though I try to
enforce md5 password protection.
The relevant line in pg_hba.conf is this:
host all mette,mkrist 10.10.0.0 255.255.0.0 md5
If I'm logged in as the Linux user "mkrist" and try to log in to a database as
either the pgsql user "mette" or the pgsql user "mkrist" it requires me to
enter a password (which it then accepts and logs me in).
But if I'm OTOH logged in as the Linux user "mette" it only requires me to
enter a password if I try to login to a database with the pgsql user "mkrist"
(which it then accepts). If I try to login as the pgsql user "mette" it logs
in without asking for a password.
I can't find anything in the documentation about exceptions from the
pg_hba.conf rules, so I'm quite surprised by this behaviour.
Thank you, I'd appreciate any help.
--
Michael Kristensen <mkrist@binf.ku.dk>
IT-studentermedhjælper / Sysadm student aid
BINF
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: Trouble setting up access privileges
2008-09-15 15:43 Trouble setting up access privileges mkrist@binf.ku.dk
@ 2008-09-15 17:08 ` Tom Lane <tgl@sss.pgh.pa.us>
2008-09-15 17:41 ` Re: Trouble setting up access privileges mkrist@binf.ku.dk
0 siblings, 1 reply; 3+ messages in thread
From: Tom Lane @ 2008-09-15 17:08 UTC (permalink / raw)
To: mkrist@binf.ku.dk; +Cc: pgsql-admin
mkrist@binf.ku.dk writes:
> The relevant line in pg_hba.conf is this:
> host all mette,mkrist 10.10.0.0 255.255.0.0 md5
What are the *other* lines in pg_hba.conf?
> I can't find anything in the documentation about exceptions from the
> pg_hba.conf rules,
There aren't any. The likely explanations are that (1) some earlier
line in pg_hba.conf is capturing the connection, (2) you are looking
at the wrong copy of pg_hba.conf, (3) you edited pg_hba.conf but
forgot to SIGHUP the postmaster, (4) you have a ~/.pgpass file on
the client side that is silently supplying a password in some of
these cases.
regards, tom lane
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: Trouble setting up access privileges
2008-09-15 15:43 Trouble setting up access privileges mkrist@binf.ku.dk
2008-09-15 17:08 ` Re: Trouble setting up access privileges Tom Lane <tgl@sss.pgh.pa.us>
@ 2008-09-15 17:41 ` mkrist@binf.ku.dk
0 siblings, 0 replies; 3+ messages in thread
From: mkrist@binf.ku.dk @ 2008-09-15 17:41 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: pgsql-admin
On Mon, Sep 15, 2008 at 01:08:08PM -0400, Tom Lane wrote:
...
> forgot to SIGHUP the postmaster, (4) you have a ~/.pgpass file on
> the client side that is silently supplying a password in some of
> these cases.
It seems the user had this ~/.pgpass file and that this was the reason. Thanks
for pointing out the possibility.
Why isn't this ~/.pgpass file documented in
http://www.postgresql.org/docs/8.3/static/auth-pg-hba-conf.html ?
Again, thank you, I appreciate it.
--
Michael Kristensen <mkrist@binf.ku.dk>
IT-studentermedhj?lper / Sysadm student aid
BINF
^ permalink raw reply [nested|flat] 3+ messages in thread
end of thread, other threads:[~2008-09-15 17:41 UTC | newest]
Thread overview: 3+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2008-09-15 15:43 Trouble setting up access privileges mkrist@binf.ku.dk
2008-09-15 17:08 ` Tom Lane <tgl@sss.pgh.pa.us>
2008-09-15 17:41 ` mkrist@binf.ku.dk
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox