Received: from localhost (unknown [200.46.208.211])
	by mail.postgresql.org (Postfix) with ESMTP id DA4876345EF
	for <pgsql-sql-postgresql.org@mail.postgresql.org>;
	Fri, 22 May 2009 14:39:50 -0300 (ADT)
Received: from mail.postgresql.org ([200.46.204.86])
	by localhost (mx1.hub.org [200.46.208.211]) (amavisd-maia, port 10024)
	with ESMTP id 04538-02-2 for
	<pgsql-sql-postgresql.org@mail.postgresql.org>;
	Fri, 22 May 2009 14:39:42 -0300 (ADT)
X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6
Received: from mail-gx0-f166.google.com (mail-gx0-f166.google.com
	[209.85.217.166])
	by mail.postgresql.org (Postfix) with ESMTP id 357B0633E2E
	for <pgsql-sql@postgresql.org>; Fri, 22 May 2009 14:39:44 -0300 (ADT)
Received: by gxk10 with SMTP id 10so3759212gxk.19
	for <pgsql-sql@postgresql.org>; Fri, 22 May 2009 10:39:43 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma;
	h=domainkey-signature:mime-version:received:in-reply-to:references
	:date:message-id:subject:from:to:content-type;
	bh=pTaixooRzV0e7Ln+9z8OMtlqqCgOj3hLphd0Zkggzh8=;
	b=fRhvkTxcx0oOOf9GyZRSqCLnJ3f0SzocS1xUqgNCVD0lBC+iEwAbKJNfRPCSFNi8eT
	dun2EBL+C4q+wHFRSFKeLIRzDcl5b+Ulku41DO+99Z5ksUA+bWbs5wIEwtYUdIx8mtoy
	V8ImSBtcjaLVB1/I4M/ZLS1lWhz17MimJzNKY=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma;
	h=mime-version:in-reply-to:references:date:message-id:subject:from:to
	:content-type;
	b=pIU6/bBMhYQwPNU1HLO+Wb8KZy1CXaoScIyN0LdrYi9YrTF0YJow1Fh+Ab4fME3O9S
	tsilbA6AgU2wwYoIAf9Z9dIEmcZy6uQQHYui3uRNpGcBB62U9dsZYUPdjQmVabsjsy+f
	+yJmiomlAeVY+jG258n1q7mXB95suNeY6Ryuc=
MIME-Version: 1.0
Received: by 10.150.151.7 with SMTP id y7mr8033655ybd.329.1243013983489; Fri,
	22 May 2009 10:39:43 -0700 (PDT)
In-Reply-To: <26711.1243009898@sss.pgh.pa.us>
References: <b560e3300905212337r6c7c1932i3192818835f99f69@mail.gmail.com>
	<b560e3300905220603w8444c87ib0eb4c89dfc13114@mail.gmail.com>
	<26711.1243009898@sss.pgh.pa.us>
Date: Fri, 22 May 2009 13:39:43 -0400
Message-ID: <b560e3300905221039r4c8cc072o3dfb54c5a6a9509f@mail.gmail.com>
Subject: Re: help with pg_hba.conf
From: Isaac Dover <isaacdover@gmail.com>
To: pgsql-sql@postgresql.org
Content-Type: multipart/alternative; boundary=000e0cd47e66efced4046a83be67
X-Virus-Scanned: Maia Mailguard 1.0.1
X-Spam-Status: No, hits=0.002 tagged_above=0 required=5
	tests=HTML_MESSAGE=0.001, NORMAL_HTTP_TO_IP=0.001
X-Spam-Level: 
X-Archive-Number: 200905/100
X-Sequence-Number: 32592

--000e0cd47e66efced4046a83be67
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

thank you _SO_ much. I'm not sure how I overlooked that, but it is far
easier to manage using connect. I'm assuming that even if tables have public
privileges granted, that they are not visible to people not granted connect
privileges to the database?

Thanks,
Isaac

On Fri, May 22, 2009 at 12:31 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:

> Isaac Dover <isaacdover@gmail.com> writes:
> >> As far as i can tell,
> >> pg_hba.conf is the only manner in which to prevent users from connecting
> to
> >> other users' databases. I've restricted roles to connecting only using
> >> sameuser:
> >>
> >> host sameuser all 192.168.168.0/24 md5
>
> In recent releases (certainly 8.3) the better approach is probably to
> use CONNECT privilege to grant or deny access.  However that does have
> some drawbacks if you intend to let users create their own databases
> --- they have to remember to set the privileges properly on new DBs.
>
>                        regards, tom lane
>

--000e0cd47e66efced4046a83be67
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

thank you _SO_ much. I&#39;m not sure how I overlooked that, but it is far =
easier to manage using connect. I&#39;m assuming that even if tables have p=
ublic privileges granted, that they are not visible to people not granted c=
onnect privileges to the database?<br>
<br>Thanks,<br>Isaac<br><br><div class=3D"gmail_quote">On Fri, May 22, 2009=
 at 12:31 PM, Tom Lane <span dir=3D"ltr">&lt;<a href=3D"mailto:tgl@sss.pgh.=
pa.us">tgl@sss.pgh.pa.us</a>&gt;</span> wrote:<br><blockquote class=3D"gmai=
l_quote" style=3D"border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0p=
t 0pt 0.8ex; padding-left: 1ex;">
<div class=3D"im">Isaac Dover &lt;<a href=3D"mailto:isaacdover@gmail.com">i=
saacdover@gmail.com</a>&gt; writes:<br>
&gt;&gt; As far as i can tell,<br>
&gt;&gt; pg_hba.conf is the only manner in which to prevent users from conn=
ecting to<br>
&gt;&gt; other users&#39; databases. I&#39;ve restricted roles to connectin=
g only using<br>
&gt;&gt; sameuser:<br>
&gt;&gt;<br>
&gt;&gt; host sameuser all <a href=3D"http://192.168.168.0/24" target=3D"_b=
lank">192.168.168.0/24</a> md5<br>
<br>
</div>In recent releases (certainly 8.3) the better approach is probably to=
<br>
use CONNECT privilege to grant or deny access. =A0However that does have<br=
>
some drawbacks if you intend to let users create their own databases<br>
--- they have to remember to set the privileges properly on new DBs.<br>
<br>
 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0regards, tom lane<br>
</blockquote></div><br>

--000e0cd47e66efced4046a83be67--