From: Jonathan S. Katz <jkatz@postgresql.org>
To: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
To: Pg Docs <pgsql-docs@lists.postgresql.org>
Subject: Re: initdb recommendations
Date: Mon, 8 Apr 2019 08:41:04 -0400
Message-ID: <6a40441e-c6dc-a707-a034-1a8261b79c33@postgresql.org> (raw)
In-Reply-To: <0258afa0-db19-3694-d34b-7f6b33ae81d0@2ndquadrant.com>
References: <bec17f0a-ddb1-8b95-5e69-368d9d0a3390@postgresql.org>
<0258afa0-db19-3694-d34b-7f6b33ae81d0@2ndquadrant.com>
On 4/8/19 8:25 AM, Peter Eisentraut wrote:
> On 2019-04-05 18:11, Jonathan S. Katz wrote:
>> + <para>
>> + We recommend using the <option>-W</option>, <option>--pwprompt</option>,
>> + or <option>--pwfile</option> flags to assign a password to the database
>> + superuser, and to override the <filename>pg_hba.conf</filename> default
>> + generation using <option>-auth-local peer</option> for local connections,
>> + and <option>-auth-host scram-sha-256</option> for remote connections. See
>> + <xref linkend="client-authentication"/> for more information on client
>> + authentication methods.
>> + </para>
>
> As discussed on hackers, we are not ready to support scram-sha-256 out
> of the box. So this advice, or any similar advice elsewhere, would need
> to recommend "md5" as the setting --- which would probably be embarrassing.
Well, it's less embarrassing than trust, and we currently state:
"Also, specify -A md5 or -A password so that the default trust
authentication mode is not used"[1]
We could also modify it to say :
"and <option>-auth-host scram-sha-256</option> for remote connections if
your client supports it, otherwise <option>-auth-host md5</option>"
Jonathan
[1] https://www.postgresql.org/docs/current/creating-cluster.htmlAttachments:
signature.asc (application/pgp-signature, 832B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: jkatz@postgresql.org, peter.eisentraut@2ndquadrant.com, pgsql-docs@lists.postgresql.org
Subject: Re: initdb recommendations
In-Reply-To: <6a40441e-c6dc-a707-a034-1a8261b79c33@postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox