Received: from localhost (maia-5.hub.org [200.46.204.182]) by postgresql.org (Postfix) with ESMTP id C18E99FB2C7 for ; Tue, 6 Feb 2007 22:36:48 -0400 (AST) Received: from postgresql.org ([200.46.204.71]) by localhost (mx1.hub.org [200.46.204.182]) (amavisd-new, port 10024) with ESMTP id 65972-01 for ; Tue, 6 Feb 2007 22:36:40 -0400 (AST) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.4 Received: from ug-out-1314.google.com (ug-out-1314.google.com [66.249.92.173]) by postgresql.org (Postfix) with ESMTP id 52C6A9FB2B9 for ; Tue, 6 Feb 2007 22:36:45 -0400 (AST) Received: by ug-out-1314.google.com with SMTP id k3so59332ugf for ; Tue, 06 Feb 2007 18:36:43 -0800 (PST) DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:user-agent:mime-version:to:subject:content-type:content-transfer-encoding; b=V8EzlY40VpzrTMs69x4O0vPM4qTl0UttecKGw0J1hDQb9Ceav/Yxe+nxD8SPvwe1CE2UGMu1dU5xNlPO6Vklv058tyo4IiLPNeglWF8xsujx9szQT14mXsAJpilIXe/wPF+lWiiktDhxXR13LsiHIuWYdsp3mYQGZH5OPLFavQ8= Received: by 10.67.96.14 with SMTP id y14mr4146788ugl.1170815803571; Tue, 06 Feb 2007 18:36:43 -0800 (PST) Received: from magicaltrevor.lan ( [194.109.234.123]) by mx.google.com with ESMTP id y7sm386706ugc.2007.02.06.18.36.43; Tue, 06 Feb 2007 18:36:43 -0800 (PST) Message-ID: <45C93D68.2050101@gmail.com> Date: Wed, 07 Feb 2007 03:46:00 +0100 From: bubblboy User-Agent: Thunderbird 2.0b1 (X11/20070117) MIME-Version: 1.0 To: pgsql-docs@postgresql.org Subject: Online documentation unclear about authentication defaults Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: Maia Mailguard 1.0.1 X-Archive-Number: 200702/5 X-Sequence-Number: 4136 Hi, After following the postgresql tutorial for setting up a postgresql server [1] I noticed that I could log in without entering my password. The documentation did not tell me this (maybe I overlooked it), eventhough it does show you how to create roles with passwords. In my opinion it would be a good idea to include a warning like "the default installation trusts everybody that can make a connection to the database" because it could lead to some (problematic) confusions. I didn't check extensively in the docs to see if there actually was such a warning, particularly because I felt that if there was, it was probably not prominent enough (or I would have noticed). Sorry if there was indeed a big warning splattered over the tutorial somewhere. Greetings, bb [1] http://www.postgresql.org/docs/8.2/interactive/installation.html