DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma;
	h=message-id:date:from:to:subject:cc:in-reply-to:mime-version
	:content-type:content-transfer-encoding:content-disposition
	:references;
	b=FreCGb13N9l2sKkN8mbiGkNaX3ZVEnrqo0FNuZLDrSwcvBjD5/NzdW6sswMIxoiVZV
	aVutgiyQr4TM7D1QKC8ceZE3BH8pY3Zp6wND9flY32eXVDRaxDGMwQvA2iPQiVPLdlup
	6TA/JtkEvlW8xHKYPnbFgGILr/I7ycSNxmxe8=
Message-ID: <dcc563d10807311839y1d127bc0g203b8b57be986cce@mail.gmail.com>
Date: Thu, 31 Jul 2008 19:39:59 -0600
From: "Scott Marlowe" <scott.marlowe@gmail.com>
To: "Rafael Domiciano" <rafael.domiciano@gmail.com>
Subject: Re: Postgres User Can Login without a password
Cc: "pgsql-admin@postgresql.org" <pgsql-admin@postgresql.org>
In-Reply-To: <3a0028490807311208m687e37d5k11c7e72bfc1da5d@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <3a0028490807311208m687e37d5k11c7e72bfc1da5d@mail.gmail.com>

On Thu, Jul 31, 2008 at 1:08 PM, Rafael Domiciano
<rafael.domiciano@gmail.com> wrote:
> Hi there,
>
> I have a situation that is a bit strange.
> I discovered today that I can login in programs like EMS SQL Manager and in
> the internal software (via ODBC) without using the password for the user.
>
> Example:
> Configuration on the ODBC:
> datasource: postgres
> database: Postgres
> server: "IP"
> user: 123456
> password: 123456
>
> The software connect to the ODBC getting the configs of the data source.
> And when I clear the password in the ODBC the software continues to work,
> without a passwd error.
> I certified with the programers, and the software doesn't pass the password.

You're likely logging in from the same machine and pg_hba.conf is set
to ident authentication.

Change your pg_hba.conf back to ident or trust, and run this command:

alter user postgres set password='password';

changing 'password' of course

Then change pg_hba.conf to md5 authentication.