From: Jonathan S. Katz <jkatz@postgresql.org>
To: Magnus Hagander <magnus@hagander.net>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Pg Docs <pgsql-docs@lists.postgresql.org>
Subject: Re: initdb recommendations
Date: Mon, 8 Apr 2019 08:46:00 -0400
Message-ID: <7b0096cc-e285-65f8-5535-ba11dbddeda6@postgresql.org> (raw)
In-Reply-To: <CABUevEwAyLrcc9-9WVEN=YgHO+knJ-osL0WeoBHenbor7S8+UA@mail.gmail.com>
References: <bec17f0a-ddb1-8b95-5e69-368d9d0a3390@postgresql.org>
<0258afa0-db19-3694-d34b-7f6b33ae81d0@2ndquadrant.com>
<6a40441e-c6dc-a707-a034-1a8261b79c33@postgresql.org>
<CABUevEwAyLrcc9-9WVEN=YgHO+knJ-osL0WeoBHenbor7S8+UA@mail.gmail.com>
On 4/8/19 8:44 AM, Magnus Hagander wrote:
> On Mon, Apr 8, 2019 at 2:41 PM Jonathan S. Katz <jkatz@postgresql.org
> <mailto:jkatz@postgresql.org>> wrote:
>
> On 4/8/19 8:25 AM, Peter Eisentraut wrote:
> > On 2019-04-05 18:11, Jonathan S. Katz wrote:
> >> + <para>
> >> + We recommend using the <option>-W</option>,
> <option>--pwprompt</option>,
> >> + or <option>--pwfile</option> flags to assign a password to
> the database
> >> + superuser, and to override the
> <filename>pg_hba.conf</filename> default
> >> + generation using <option>-auth-local peer</option> for
> local connections,
> >> + and <option>-auth-host scram-sha-256</option> for remote
> connections. See
> >> + <xref linkend="client-authentication"/> for more
> information on client
> >> + authentication methods.
> >> + </para>
> >
> > As discussed on hackers, we are not ready to support scram-sha-256 out
> > of the box. So this advice, or any similar advice elsewhere,
> would need
> > to recommend "md5" as the setting --- which would probably be
> embarrassing.
>
> Well, it's less embarrassing than trust, and we currently state:
>
>
> Yes. Much less.
>
>
> "Also, specify -A md5 or -A password so that the default trust
> authentication mode is not used"[1]
>
> We could also modify it to say :
>
> "and <option>-auth-host scram-sha-256</option> for remote connections if
> your client supports it, otherwise <option>-auth-host md5</option>"
>
>
> That would be the best from a correctness, but if of course also makes
> things sound more complicated. I'm not sure where the right balance is
> there.
We could link here[1] from the docs on the line for "client supports it"
Jonathan
[1] https://wiki.postgresql.org/wiki/List_of_driversAttachments:
signature.asc (application/pgp-signature, 832B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: jkatz@postgresql.org, magnus@hagander.net, peter.eisentraut@2ndquadrant.com, pgsql-docs@lists.postgresql.org
Subject: Re: initdb recommendations
In-Reply-To: <7b0096cc-e285-65f8-5535-ba11dbddeda6@postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox