From: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
To: pgsql-hackers <pgsql-hackers@postgresql.org>
Cc: Noah Misch <noah@leadboat.com>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: Jonathan S. Katz <jkatz@postgresql.org>
Subject: Re: initdb recommendations
Date: Thu, 23 May 2019 18:54:27 +0200
Message-ID: <96389374-9454-d26d-6f79-7c7b15ec14bd@2ndquadrant.com> (raw)
In-Reply-To: <20190406180839.GA1921989@rfd.leadboat.com>
References: <bec17f0a-ddb1-8b95-5e69-368d9d0a3390@postgresql.org>
<f27d3170-76cf-4afb-1e1a-b1059295ec8d@2ndquadrant.com>
<CABUevExMizVYea9zaHBte66u9KipEgfwcsaE9spfqK9iYRST_g@mail.gmail.com>
<20190406180839.GA1921989@rfd.leadboat.com>
On 2019-04-06 20:08, Noah Misch wrote:
>>> I think we should just change the defaults. There is a risk of warning
>>> fatigue. initdb does warn about this, so anyone who cared could have
>>> gotten the information.
>>>
>>
>> I've been suggesting that for years, so definite strong +1 for doing that.
>
> +1
To recap, the idea here was to change the default authentication methods
that initdb sets up, in place of "trust".
I think the ideal scenario would be to use "peer" for local and some
appropriate password method (being discussed elsewhere) for host.
Looking through the buildfarm, I gather that the only platforms that
don't support peer are Windows, AIX, and HP-UX. I think we can probably
figure out some fallback or alternative default for the latter two
platforms without anyone noticing. But what should the defaults be on
Windows? It doesn't have local sockets, so the lack of peer wouldn't
matter. But is it OK to default to a password method, or would that
upset people particularly?
--
Peter Eisentraut http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: peter.eisentraut@2ndquadrant.com, pgsql-hackers@postgresql.org, noah@leadboat.com, magnus@hagander.net, jkatz@postgresql.org
Subject: Re: initdb recommendations
In-Reply-To: <96389374-9454-d26d-6f79-7c7b15ec14bd@2ndquadrant.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox