Received: from maia.hub.org (unknown [200.46.204.183]) by mail.postgresql.org (Postfix) with ESMTP id E15B6632A63 for ; Fri, 22 May 2009 13:31:45 -0300 (ADT) Received: from mail.postgresql.org ([200.46.204.86]) by maia.hub.org (mx1.hub.org [200.46.204.183]) (amavisd-maia, port 10024) with ESMTP id 73422-04 for ; Fri, 22 May 2009 13:31:42 -0300 (ADT) X-Greylist: from auto-whitelisted by SQLgrey-1.7.6 Received: from sss.pgh.pa.us (sss.pgh.pa.us [66.207.139.130]) by mail.postgresql.org (Postfix) with ESMTP id 06E546321E2 for ; Fri, 22 May 2009 13:31:41 -0300 (ADT) Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1]) by sss.pgh.pa.us (8.14.2/8.14.2) with ESMTP id n4MGVcCT026712; Fri, 22 May 2009 12:31:38 -0400 (EDT) To: Isaac Dover cc: pgsql-sql@postgresql.org Subject: Re: help with pg_hba.conf In-reply-to: References: Comments: In-reply-to Isaac Dover message dated "Fri, 22 May 2009 09:03:01 -0400" Date: Fri, 22 May 2009 12:31:38 -0400 Message-ID: <26711.1243009898@sss.pgh.pa.us> From: Tom Lane X-Virus-Scanned: Maia Mailguard 1.0.1 X-Spam-Status: No, hits=0 tagged_above=0 required=5 tests=none X-Spam-Level: X-Archive-Number: 200905/99 X-Sequence-Number: 32591 Isaac Dover writes: >> As far as i can tell, >> pg_hba.conf is the only manner in which to prevent users from connecting to >> other users' databases. I've restricted roles to connecting only using >> sameuser: >> >> host sameuser all 192.168.168.0/24 md5 In recent releases (certainly 8.3) the better approach is probably to use CONNECT privilege to grant or deny access. However that does have some drawbacks if you intend to let users create their own databases --- they have to remember to set the privileges properly on new DBs. regards, tom lane