DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma;
	h=mime-version:in-reply-to:references:date:message-id:subject:from:to
	:content-type;
	b=NnY1s4A/0xD90seERRahl7CMlvDCPuGKXyaNNtP8wvGtNPTR5QJ8JJJFxILGYcanFH
	CcqBdkMzOPr00l0nFUB6xU1E9cFd5ZIg84kTRH0++VNlQsgAGViell94zUwlyoo7u2m7
	F0Lnfm0/ZA6y5H3O+6fnddXQuW+KZDq34AbtI=
MIME-Version: 1.0
In-Reply-To: <b560e3300905212337r6c7c1932i3192818835f99f69@mail.gmail.com>
References: <b560e3300905212337r6c7c1932i3192818835f99f69@mail.gmail.com>
Date: Fri, 22 May 2009 09:03:01 -0400
Message-ID: <b560e3300905220603w8444c87ib0eb4c89dfc13114@mail.gmail.com>
Subject: Re: help with pg_hba.conf
From: Isaac Dover <isaacdover@gmail.com>
To: pgsql-sql@postgresql.org
Content-Type: multipart/alternative; boundary=000e0cd5d054640420046a7fe110

--000e0cd5d054640420046a7fe110
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

possibly this answers my question, and what i am doing is indeed the most
appropriate?

"Databases are physically separated and access control is managed at the
connection level."

from 8.3 docs, section 20.1

thanks,
Isaac

On Fri, May 22, 2009 at 2:37 AM, Isaac Dover <isaacdover@gmail.com> wrote:

> Hello, to this point i've been working with pg_hba.conf authentication
> defaults as installed with PostgreSQL 8.3. I'm trying to better understand
> "best practice" for managing connections to databases (I've grown accustomed
> to the MSSQL EM method of assigning user privileges). As far as i can tell,
> pg_hba.conf is the only manner in which to prevent users from connecting to
> other users' databases. I've restricted roles to connecting only using
> sameuser:
>
> host sameuser all 192.168.168.0/24 md5
>
> this works fine until a user connects and creates a new database. Pg shows
> that the owner of the database is the currently connected user, but the user
> can't connect to it, as the hba.conf file has the sameuser restriction. I
> was hoping that (somehow, magically) the owner of the database could always
> connect to the databases he/she owns.
>
> Is hba.conf the only way to restrict users connections to specific
> databases? Are there privileges I can grant without having to maintain this
> file?
>
> I've spent quite some time researching this, even with the documentation,
> but I'm wondering what I'm missing.
>
> Thanks,
> Isaac
>

--000e0cd5d054640420046a7fe110
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

possibly this answers my question, and what i am doing is indeed the most a=
ppropriate?<br><br>&quot;Databases are    physically separated and access c=
ontrol is managed at the    connection level.&quot;<br><br>from 8.3 docs, s=
ection 20.1<br>
<br>thanks,<br>Isaac<br><br><div class=3D"gmail_quote">On Fri, May 22, 2009=
 at 2:37 AM, Isaac Dover <span dir=3D"ltr">&lt;<a href=3D"mailto:isaacdover=
@gmail.com">isaacdover@gmail.com</a>&gt;</span> wrote:<br><blockquote class=
=3D"gmail_quote" style=3D"border-left: 1px solid rgb(204, 204, 204); margin=
: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>Hello,=A0to this point i&#39;ve been working with pg_hba.conf authenti=
cation defaults as installed with PostgreSQL 8.3. I&#39;m trying to better =
understand &quot;best practice&quot; for managing connections to databases =
(I&#39;ve grown accustomed to the MSSQL EM method of assigning user privile=
ges). As far as i can tell, pg_hba.conf is the only manner in which to prev=
ent users from connecting to other users&#39; databases. I&#39;ve restricte=
d roles to connecting only using sameuser:</div>


<div>=A0</div>
<div>host sameuser all <a href=3D"http://192.168.168.0/24" target=3D"_blank=
">192.168.168.0/24</a> md5</div>
<div>=A0</div>
<div>this works fine until a user connects and creates a new database. Pg s=
hows that the owner of the database is the currently connected user, but th=
e user can&#39;t connect to it, as the hba.conf file has the sameuser restr=
iction. I was hoping that (somehow, magically) the owner of the database co=
uld always connect to the databases he/she owns.</div>


<div>=A0</div>
<div>Is hba.conf the only way to restrict users connections to specific dat=
abases? Are there privileges I can grant without having to maintain this fi=
le? </div>
<div>=A0</div>
<div>I&#39;ve spent quite some time researching this, even with the documen=
tation, but I&#39;m wondering what I&#39;m missing.</div>
<div>=A0</div>
<div>Thanks,</div>
<div>Isaac</div>
</blockquote></div><br>

--000e0cd5d054640420046a7fe110--