Resent-From: alvherre@alvh.no-ip.org
Resent-Date: Wed, 7 Feb 2007 16:16:06 -0300
Resent-Message-ID: <20070207191606.GK22146@alvh.no-ip.org>
Resent-To: pgsql-docs@postgresql.org
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:user-agent:mime-version:to:subject:references:in-reply-to:content-type:content-transfer-encoding;
	b=mIUvACCBaFOuM9Kz/f+9xrMfZ3InP3+OUPKoPmxhlOGDT0UbO74Vg8EMQsJBpBq2JZvvgCNv2Otb5Qfm2XTMlLvUHzZPk7Zuvdp8xHib/eMhMwW1MWbP01QyCjbjw/HPsfPffH5vnizpDWiuddD15SEI2iz1E6IwcWRj6DpYgDs=
Message-ID: <45C9879A.1020809@gmail.com>
Date: Wed, 07 Feb 2007 09:02:34 +0100
From: bubblboy <bubblboy@gmail.com>
User-Agent: Thunderbird 2.0b1 (X11/20070117)
MIME-Version: 1.0
To: Alvaro Herrera <alvherre@commandprompt.com>
Cc: pgsql-docs@postgresql.org
Subject: Re: Online documentation unclear about authentication defaults
References: <45C93D68.2050101@gmail.com>
	<20070207034355.GG11742@alvh.no-ip.org>
In-Reply-To: <20070207034355.GG11742@alvh.no-ip.org>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

Alvaro Herrera wrote:
> bubblboy wrote:
>> Hi,
>>
>> After following the postgresql tutorial for setting up a postgresql 
>> server [1] I noticed that I could log in without entering my password. 
>> The documentation did not tell me this (maybe I overlooked it), 
>> eventhough it does show you how to create roles with passwords. In my 
>> opinion it would be a good idea to include a warning like "the default 
>> installation trusts everybody that can make a connection to the 
>> database" because it could lead to some (problematic) confusions.
>>
>> I didn't check extensively in the docs to see if there actually was such 
>> a warning, particularly because I felt that if there was, it was 
>> probably not prominent enough (or I would have noticed). Sorry if there 
>> was indeed a big warning splattered over the tutorial somewhere.
> 
> The tutorial indeed neglects warning you about that, but initdb doesn't.
> It outputs these lines
> 
> WARNING: enabling "trust" authentication for local connections
> You can change this by editing pg_hba.conf or using the -A option the
> next time you run initdb.
> 
> 
> Maybe this is not strong enough, or not scary enough?

Hmm,

You are right, I ran initdb a few weeks ago and continued today. 
Personally, I would say that it wouldn't be a bad idea to include a 
second warning in the documentation nonetheless, just to emphasize it 
(or maybe make the initdb message a little more prominent - who knows). 
I can imagine that I saw all that output and thought "oh well, I'm 
following the tutorial so this won't be very interesting", but maybe 
(probably) that's just plain stupid :)

Greetings,
bb