Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit8a02339

Browse files
committed
initdb: Add options --auth-local and --auth-host
reviewed by Robert Haas and Pavel Stehule
1 parent69f4f1c commit8a02339

File tree

3 files changed

+134
-62
lines changed

3 files changed

+134
-62
lines changed

‎doc/src/sgml/ref/initdb.sgml

Lines changed: 27 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -118,10 +118,33 @@ PostgreSQL documentation
118118
<term><option>--auth=<replaceable class="parameter">authmethod</replaceable></option></term>
119119
<listitem>
120120
<para>
121-
This option specifies the authentication method for local users
122-
used in <filename>pg_hba.conf</>. Do not use <literal>trust</>
123-
unless you trust all local users on your system. <literal>Trust</>
124-
is the default for ease of installation.
121+
This option specifies the authentication method for local users used
122+
in <filename>pg_hba.conf</> (<literal>host</literal>
123+
and <literal>local</literal> lines). Do not use <literal>trust</>
124+
unless you trust all local users on your system. <literal>trust</> is
125+
the default for ease of installation.
126+
</para>
127+
</listitem>
128+
</varlistentry>
129+
130+
<varlistentry>
131+
<term><option>--auth-host=<replaceable class="parameter">authmethod</replaceable></option></term>
132+
<listitem>
133+
<para>
134+
This option specifies the authentication method for local users via
135+
TCP/IP connections used in <filename>pg_hba.conf</>
136+
(<literal>host</literal> lines).
137+
</para>
138+
</listitem>
139+
</varlistentry>
140+
141+
<varlistentry>
142+
<term><option>--auth-local=<replaceable class="parameter">authmethod</replaceable></option></term>
143+
<listitem>
144+
<para>
145+
This option specifies the authentication method for local users via
146+
Unix-domain socket connections used in <filename>pg_hba.conf</>
147+
(<literal>local</literal> lines).
125148
</para>
126149
</listitem>
127150
</varlistentry>

‎src/backend/libpq/pg_hba.conf.sample

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -79,11 +79,11 @@
7979
@remove-line-for-nolocal@# "local" is for Unix domain socket connections only
8080
@remove-line-for-nolocal@local all all @authmethodlocal@
8181
# IPv4 local connections:
82-
host all all 127.0.0.1/32 @authmethod@
82+
host all all 127.0.0.1/32 @authmethodhost@
8383
# IPv6 local connections:
84-
host all all ::1/128 @authmethod@
84+
host all all ::1/128 @authmethodhost@
8585
# Allow replication connections from localhost, by a user with the
8686
# replication privilege.
8787
@remove-line-for-nolocal@#local replication @default_username@ @authmethodlocal@
88-
#host replication @default_username@ 127.0.0.1/32 @authmethod@
89-
#host replication @default_username@ ::1/128 @authmethod@
88+
#host replication @default_username@ 127.0.0.1/32 @authmethodhost@
89+
#host replication @default_username@ ::1/128 @authmethodhost@

‎src/bin/initdb/initdb.c

Lines changed: 103 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,34 @@
6464
/* Ideally this would be in a .h file, but it hardly seems worth the trouble */
6565
externconstchar*select_default_timezone(constchar*share_path);
6666

67+
staticconstchar*auth_methods_host[]= {"trust","reject","md5","password","ident","radius",
68+
#ifdefENABLE_GSS
69+
"gss",
70+
#endif
71+
#ifdefENABLE_SSPI
72+
"sspi",
73+
#endif
74+
#ifdefKRB5
75+
"krb5",
76+
#endif
77+
#ifdefUSE_PAM
78+
"pam","pam ",
79+
#endif
80+
#ifdefUSE_LDAP
81+
"ldap",
82+
#endif
83+
#ifdefUSE_SSL
84+
"cert",
85+
#endif
86+
NULL};
87+
staticconstchar*auth_methods_local[]= {"trust","reject","md5","password","peer","radius",
88+
#ifdefUSE_PAM
89+
"pam","pam ",
90+
#endif
91+
#ifdefUSE_LDAP
92+
"ldap",
93+
#endif
94+
NULL};
6795

6896
/*
6997
* these values are passed in by makefile defines
@@ -84,8 +112,8 @@ static const char *default_text_search_config = "";
84112
staticchar*username="";
85113
staticboolpwprompt= false;
86114
staticchar*pwfilename=NULL;
87-
staticchar*authmethod="";
88-
staticchar*authmethodlocal="";
115+
staticconstchar*authmethodhost="";
116+
staticconstchar*authmethodlocal="";
89117
staticbooldebug= false;
90118
staticboolnoclean= false;
91119
staticboolshow_setting= false;
@@ -1090,15 +1118,15 @@ setup_config(void)
10901118

10911119
/* Replace default authentication methods */
10921120
conflines=replace_token(conflines,
1093-
"@authmethod@",
1094-
authmethod);
1121+
"@authmethodhost@",
1122+
authmethodhost);
10951123
conflines=replace_token(conflines,
10961124
"@authmethodlocal@",
10971125
authmethodlocal);
10981126

10991127
conflines=replace_token(conflines,
11001128
"@authcomment@",
1101-
strcmp(authmethod,"trust")!=0?"" :AUTHTRUST_WARNING);
1129+
(strcmp(authmethodlocal,"trust")==0||strcmp(authmethodhost,"trust")==0) ?AUTHTRUST_WARNING :"");
11021130

11031131
/* Replace username for replication */
11041132
conflines=replace_token(conflines,
@@ -2452,6 +2480,8 @@ usage(const char *progname)
24522480
printf(_(" %s [OPTION]... [DATADIR]\n"),progname);
24532481
printf(_("\nOptions:\n"));
24542482
printf(_(" -A, --auth=METHOD default authentication method for local connections\n"));
2483+
printf(_(" --auth-host=METHOD default authentication method for local TCP/IP connections\n"));
2484+
printf(_(" --auth-local=METHOD default authentication method for local-socket connections\n"));
24552485
printf(_(" [-D, --pgdata=]DATADIR location for this database cluster\n"));
24562486
printf(_(" -E, --encoding=ENCODING set default encoding for new databases\n"));
24572487
printf(_(" --locale=LOCALE set default locale for new databases\n"));
@@ -2479,6 +2509,50 @@ usage(const char *progname)
24792509
printf(_("\nReport bugs to <pgsql-bugs@postgresql.org>.\n"));
24802510
}
24812511

2512+
staticvoid
2513+
check_authmethod_unspecified(constchar**authmethod)
2514+
{
2515+
if (*authmethod==NULL||strlen(*authmethod)==0)
2516+
{
2517+
authwarning=_("\nWARNING: enabling \"trust\" authentication for local connections\n"
2518+
"You can change this by editing pg_hba.conf or using the option -A, or\n"
2519+
"--auth-local and --auth-host, the next time you run initdb.\n");
2520+
*authmethod="trust";
2521+
}
2522+
}
2523+
2524+
staticvoid
2525+
check_authmethod_valid(constchar*authmethod,constchar**valid_methods,constchar*conntype)
2526+
{
2527+
constchar**p;
2528+
2529+
for (p=valid_methods;*p;p++)
2530+
{
2531+
if (strcmp(authmethod,*p)==0)
2532+
return;
2533+
/* with space = param */
2534+
if (strchr(authmethod,' '))
2535+
if (strncmp(authmethod,*p, (authmethod-strchr(authmethod,' ')))==0)
2536+
return;
2537+
}
2538+
2539+
fprintf(stderr,_("%s: invalid authentication method \"%s\" for \"%s\" connections\n"),
2540+
progname,authmethod,conntype);
2541+
exit(1);
2542+
}
2543+
2544+
staticvoid
2545+
check_need_password(constchar*authmethod)
2546+
{
2547+
if ((strcmp(authmethod,"md5")==0||
2548+
strcmp(authmethod,"password")==0)&&
2549+
!(pwprompt||pwfilename))
2550+
{
2551+
fprintf(stderr,_("%s: must specify a password for the superuser to enable %s authentication\n"),progname,authmethod);
2552+
exit(1);
2553+
}
2554+
}
2555+
24822556
int
24832557
main(intargc,char*argv[])
24842558
{
@@ -2499,6 +2573,8 @@ main(int argc, char *argv[])
24992573
{"no-locale",no_argument,NULL,8},
25002574
{"text-search-config",required_argument,NULL,'T'},
25012575
{"auth",required_argument,NULL,'A'},
2576+
{"auth-local",required_argument,NULL,10},
2577+
{"auth-host",required_argument,NULL,11},
25022578
{"pwprompt",no_argument,NULL,'W'},
25032579
{"pwfile",required_argument,NULL,9},
25042580
{"username",required_argument,NULL,'U'},
@@ -2567,7 +2643,22 @@ main(int argc, char *argv[])
25672643
switch (c)
25682644
{
25692645
case'A':
2570-
authmethod=xstrdup(optarg);
2646+
authmethodlocal=authmethodhost=xstrdup(optarg);
2647+
/*
2648+
* When ident is specified, use peer for local connections.
2649+
* Mirrored, when peer is specified, use ident for TCP/IP
2650+
* connections.
2651+
*/
2652+
if (strcmp(authmethodhost,"ident")==0)
2653+
authmethodlocal="peer";
2654+
elseif (strcmp(authmethodlocal,"peer")==0)
2655+
authmethodhost="ident";
2656+
break;
2657+
case10:
2658+
authmethodlocal=xstrdup(optarg);
2659+
break;
2660+
case11:
2661+
authmethodhost=xstrdup(optarg);
25712662
break;
25722663
case'D':
25732664
pg_data=xstrdup(optarg);
@@ -2659,56 +2750,14 @@ main(int argc, char *argv[])
26592750
exit(1);
26602751
}
26612752

2662-
if (authmethod==NULL|| !strlen(authmethod))
2663-
{
2664-
authwarning=_("\nWARNING: enabling \"trust\" authentication for local connections\n"
2665-
"You can change this by editing pg_hba.conf or using the -A option the\n"
2666-
"next time you run initdb.\n");
2667-
authmethod="trust";
2668-
}
2753+
check_authmethod_unspecified(&authmethodlocal);
2754+
check_authmethod_unspecified(&authmethodhost);
26692755

2670-
if (strcmp(authmethod,"md5")!=0&&
2671-
strcmp(authmethod,"peer")!=0&&
2672-
strcmp(authmethod,"ident")!=0&&
2673-
strcmp(authmethod,"trust")!=0&&
2674-
#ifdefUSE_PAM
2675-
strcmp(authmethod,"pam")!=0&&
2676-
strncmp(authmethod,"pam ",4)!=0&&/* pam with space = param */
2677-
#endif
2678-
strcmp(authmethod,"password")!=0
2679-
)
2756+
check_authmethod_valid(authmethodlocal,auth_methods_local,"local");
2757+
check_authmethod_valid(authmethodhost,auth_methods_host,"host");
26802758

2681-
/*
2682-
* Kerberos methods not listed because they are not supported over
2683-
* local connections and are rejected in hba.c
2684-
*/
2685-
{
2686-
fprintf(stderr,_("%s: unrecognized authentication method \"%s\"\n"),
2687-
progname,authmethod);
2688-
exit(1);
2689-
}
2690-
2691-
if ((strcmp(authmethod,"md5")==0||
2692-
strcmp(authmethod,"password")==0)&&
2693-
!(pwprompt||pwfilename))
2694-
{
2695-
fprintf(stderr,_("%s: must specify a password for the superuser to enable %s authentication\n"),progname,authmethod);
2696-
exit(1);
2697-
}
2698-
2699-
/*
2700-
* When ident is specified, use peer for local connections. Mirrored, when
2701-
* peer is specified, use ident for TCP connections.
2702-
*/
2703-
if (strcmp(authmethod,"ident")==0)
2704-
authmethodlocal="peer";
2705-
elseif (strcmp(authmethod,"peer")==0)
2706-
{
2707-
authmethodlocal="peer";
2708-
authmethod="ident";
2709-
}
2710-
else
2711-
authmethodlocal=authmethod;
2759+
check_need_password(authmethodlocal);
2760+
check_need_password(authmethodhost);
27122761

27132762
if (strlen(pg_data)==0)
27142763
{

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp