Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1YqSrn-0004hB-4n for pgsql-hackers@arkaria.postgresql.org; Thu, 07 May 2015 20:57:59 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.80) (envelope-from ) id 1YqSrm-00087e-0y for pgsql-hackers@arkaria.postgresql.org; Thu, 07 May 2015 20:57:58 +0000 Received: from makus.postgresql.org ([2001:4800:1501:1::229]) by malur.postgresql.org with esmtps (TLS1.2:RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from ) id 1YqSrl-00087R-08 for pgsql-hackers@postgresql.org; Thu, 07 May 2015 20:57:57 +0000 Received: from tamriel.snowman.net ([2001:4830:167b::11]) by makus.postgresql.org with esmtp (Exim 4.84) (envelope-from ) id 1YqSre-0004MK-CC for pgsql-hackers@postgresql.org; Thu, 07 May 2015 20:57:55 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id 9CF615F7A9; Thu, 7 May 2015 16:57:49 -0400 (EDT) Date: Thu, 7 May 2015 16:57:49 -0400 From: Stephen Frost To: Robert Haas Cc: Josh Berkus , Tom Lane , Andrew Dunstan , Alvaro Herrera , Volker =?iso-8859-1?Q?A=DFmann?= , "pgsql-hackers@postgresql.org" Subject: Re: Disabling trust/ident authentication configure option Message-ID: <20150507205749.GE30322@tamriel.snowman.net> References: <20150506144724.GU2523@alvh.no-ip.org> <554A720F.1030706@dunslane.net> <554A797B.1010101@dunslane.net> <6837.1430946793@sss.pgh.pa.us> <554A9898.9040407@agliodbs.com> <20150507150254.GA30322@tamriel.snowman.net> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="MekdDWo5JqZA69XK" Content-Disposition: inline In-Reply-To: X-Editor: Vim http://www.vim.org/ X-Info: http://www.snowman.net X-Operating-System: Linux/3.13.0-46-generic (x86_64) X-Uptime: 16:50:25 up 49 days, 2:39, 26 users, load average: 0.18, 0.12, 0.13 User-Agent: Mutt/1.5.21 (2010-09-15) X-Pg-Spam-Score: -1.9 (-) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-hackers Precedence: bulk Sender: pgsql-hackers-owner@postgresql.org --MekdDWo5JqZA69XK Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable * Robert Haas (robertmhaas@gmail.com) wrote: > On Thu, May 7, 2015 at 11:02 AM, Stephen Frost wrote: > > I realize it's not going to be popular, but I'd love to have 'trust' > > only allowed if a command-line option is passed to the postmaster or > > something along those lines. It's really got no business being an > > option for a network service like PG. >=20 > I disagree wholeheartedly. There is such a thing as a trusted network. Likely a good topic of conversation to be had in Ottawa. :) I agree that there are trusted networks, but the ones that I work with still expect network services to require authentication and authorization. Perhaps they're not really "trusted" then, from your perspective. On the other hand, I suppose if you use pg_hba to limit which accounts can be logged into with 'trust' then you might be able to have, say, a "read-only" user/database that anyone could see. That's a pretty narrow case though and I'd rather we figure out how to address it directly and more specifically (no-password login roles?) than the broad disable-all-authentication "trust" method. Thanks! Stephen --MekdDWo5JqZA69XK Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJVS9HNAAoJEO1sijiDR2RVYYcQAMbUhKs9dWJxOmL9vuVmOrKr 2aMQocSZzqZxYa7ORi9g/7igxZ2ckXdXKWXVb/k3ajyJlxQkBDy/vg8WhyHJ8Bqq hCfpSenTdgnKPL7TNaCPDTvYQKAlHDPMM3izhBAcWLA4naReKgAbxkVgAYxMY77l G6nfmjMtc7rUtjMjXrh7u/uS4YVH+U+n87Ivn5ByQa0exL6rZ2oWKFHLtvAj23DS rdjraYF6ai6n0nDavUom3RJB1JcxidbIhZFozlNIyJofHzaT9UKRX7CNUVXzo+nZ uXIOgIqcOF2YEJc+YFY8RTyt0zDtSvlDH0hIuRRoo/956druKCG0yLNsxDq6I46N s8Rzo+XmtIAxALPlv1cnuPDy+y7/KfEl87beGfy5eoBIfTX3CvDHXG2hfA7fQj/4 DPCmNfj5J4oQ9fTuCqOzPrzzfqnHUk1w9UfNX9+e3YSo3gKwP5FoMG0bVYpVut9F Z/EtOgJ7XSiMNLiLaI+BHCSCPgMTebCaqROXPHeiUhWMJvez/Yi5WECeITgqi8EN JgT2GQBey0AUDm0I+iImNJjczr0flpweGQu/XeRD/mw7N45woVTdgMKIOLa94XUh 5JrQtEMFRqSISjr+PIQ4IHkj0JfrZnWyT1sOM5GOv+VxO2pksxk+ZRUDjhqNWV1P op6xHMaMKFREQmPC0zh5 =RCWT -----END PGP SIGNATURE----- --MekdDWo5JqZA69XK--