From: bubblboy <bubblboy@gmail.com>
To: Alvaro Herrera <alvherre@commandprompt.com>
Cc: pgsql-docs@postgresql.org
Subject: Re: Online documentation unclear about authentication defaults
Date: Wed, 07 Feb 2007 09:02:34 +0100
Message-ID: <45C9879A.1020809@gmail.com> (raw)
In-Reply-To: <20070207034355.GG11742@alvh.no-ip.org>
References: <45C93D68.2050101@gmail.com>
<20070207034355.GG11742@alvh.no-ip.org>
Alvaro Herrera wrote:
> bubblboy wrote:
>> Hi,
>>
>> After following the postgresql tutorial for setting up a postgresql
>> server [1] I noticed that I could log in without entering my password.
>> The documentation did not tell me this (maybe I overlooked it),
>> eventhough it does show you how to create roles with passwords. In my
>> opinion it would be a good idea to include a warning like "the default
>> installation trusts everybody that can make a connection to the
>> database" because it could lead to some (problematic) confusions.
>>
>> I didn't check extensively in the docs to see if there actually was such
>> a warning, particularly because I felt that if there was, it was
>> probably not prominent enough (or I would have noticed). Sorry if there
>> was indeed a big warning splattered over the tutorial somewhere.
>
> The tutorial indeed neglects warning you about that, but initdb doesn't.
> It outputs these lines
>
> WARNING: enabling "trust" authentication for local connections
> You can change this by editing pg_hba.conf or using the -A option the
> next time you run initdb.
>
>
> Maybe this is not strong enough, or not scary enough?
Hmm,
You are right, I ran initdb a few weeks ago and continued today.
Personally, I would say that it wouldn't be a bad idea to include a
second warning in the documentation nonetheless, just to emphasize it
(or maybe make the initdb message a little more prominent - who knows).
I can imagine that I saw all that output and thought "oh well, I'm
following the tutorial so this won't be very interesting", but maybe
(probably) that's just plain stupid :)
Greetings,
bb
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: bubblboy@gmail.com, alvherre@commandprompt.com
Subject: Re: Online documentation unclear about authentication defaults
In-Reply-To: <45C9879A.1020809@gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox