MIME-Version: 1.0
In-Reply-To: <151948799430.1463.1674902368730219470@wrigleys.postgresql.org>
References: <151948799430.1463.1674902368730219470@wrigleys.postgresql.org>
From: Pantelis Theodosiou <ypercube@gmail.com>
Date: Sat, 24 Feb 2018 17:22:32 +0000
Message-ID: 
 <CAE3TBxzPfRr0JXHa82iq0YESK8K68RsAGwp87V8TZmdzM+OXmw@mail.gmail.com>
Subject: Re: Basic security
To: midgley.tom@gmail.com, pgsql-docs@lists.postgresql.org
Content-Type: multipart/alternative; boundary="94eb2c0ef36add9ab90565f88695"
Precedence: bulk

--94eb2c0ef36add9ab90565f88695
Content-Type: text/plain; charset="UTF-8"

Your link is for an old version of Postgres (8.3). Current version is 10.
You can find the link for the relaive page easily, it's on the top of the
page, if you use a different version that 10 (I hope you are not still at
8.3 !)

https://www.postgresql.org/docs/current/static/auth-pg-hba-conf.html

On Sat, Feb 24, 2018 at 3:59 PM, PG Doc comments form <
noreply@postgresql.org> wrote:

> The following documentation comment has been logged on the website:
>
> Page: https://www.postgresql.org/docs/8.3/static/auth-pg-hba-conf.html
> Description:
>
> My  pg_hba.conf file gives 'cert' as an authentication method.  this is not
> mentioned on this page.
>
> I think a basic pg_hba.conf to allow remote access require ssl, and to
> prevent access to the postgres table would be a useful addition.
> The more I see about this powerful environment the more nervous I get about
> exploits based on aspects of it's multitude of features of which I am
> completely unaware - what about PUBLIC for example ? ?
> A basic security guide to disable dangerous defaults would be very welcome
>

--94eb2c0ef36add9ab90565f88695
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Your link is for an old version of Postgres (8.3). Current=
 version is 10. You can find the link for the relaive page easily, it&#39;s=
 on the top of the page, if you use a different version that 10 (I hope you=
 are not still at 8.3 !)<br><br><a href=3D"https://www.postgresql.org/docs/=
current/static/auth-pg-hba-conf.html">https://www.postgresql.org/docs/curre=
nt/static/auth-pg-hba-conf.html</a><br></div><div class=3D"gmail_extra"><br=
><div class=3D"gmail_quote">On Sat, Feb 24, 2018 at 3:59 PM, PG Doc comment=
s form <span dir=3D"ltr">&lt;<a href=3D"mailto:noreply@postgresql.org" targ=
et=3D"_blank">noreply@postgresql.org</a>&gt;</span> wrote:<br><blockquote c=
lass=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;=
padding-left:1ex">The following documentation comment has been logged on th=
e website:<br>
<br>
Page: <a href=3D"https://www.postgresql.org/docs/8.3/static/auth-pg-hba-con=
f.html" rel=3D"noreferrer" target=3D"_blank">https://www.postgresql.org/<wb=
r>docs/8.3/static/auth-pg-hba-<wbr>conf.html</a><br>
Description:<br>
<br>
My=C2=A0 pg_hba.conf file gives &#39;cert&#39; as an authentication method.=
=C2=A0 this is not<br>
mentioned on this page.<br>
<br>
I think a basic pg_hba.conf to allow remote access require ssl, and to<br>
prevent access to the postgres table would be a useful addition.<br>
The more I see about this powerful environment the more nervous I get about=
<br>
exploits based on aspects of it&#39;s multitude of features of which I am<b=
r>
completely unaware - what about PUBLIC for example ? ?<br>
A basic security guide to disable dangerous defaults would be very welcome<=
br>
</blockquote></div><br></div>

--94eb2c0ef36add9ab90565f88695--