Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit9f07cb7

Browse files
committed
Add example of using 'sameuser' followed by 'all' pg_hba records to
enforce a limit on who can connect to databases other than their own.From a recent discussion in pg-admin.
1 parent09bf48c commit9f07cb7

File tree

2 files changed

+75
-43
lines changed

2 files changed

+75
-43
lines changed

‎doc/src/sgml/client-auth.sgml‎

Lines changed: 36 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<!-- $Header: /cvsroot/pgsql/doc/src/sgml/client-auth.sgml,v 1.26 2001/11/12 19:19:39 petere Exp $ -->
1+
<!-- $Header: /cvsroot/pgsql/doc/src/sgml/client-auth.sgml,v 1.27 2001/11/18 23:24:16 tgl Exp $ -->
22

33
<chapter id="client-authentication">
44
<title>Client Authentication</title>
@@ -27,9 +27,10 @@
2727
</para>
2828

2929
<para>
30-
<productname>Postgres</productname> offers client authentication by
31-
(client) host and by database, with a number of different
32-
authentication methods available.
30+
<productname>Postgres</productname> offers a number of different
31+
client authentication methods. The method to be used can be selected
32+
on the basis of (client) host and database; some authentication methods
33+
allow you to restrict by user name as well.
3334
</para>
3435

3536
<para>
@@ -197,16 +198,15 @@ hostssl <replaceable>database</replaceable> <replaceable>IP-address</replaceable
197198
<term><literal>password</></term>
198199
<listitem>
199200
<para>
200-
The client is required to supply a password with the connection
201-
attempt which is required to match the password that was set up
202-
for the user.
201+
The client is required to supply a password which is required to
202+
match the database password that was set up for the user.
203203
</para>
204204

205205
<para>
206206
An optional file name may be specified after the
207207
<literal>password</literal> keyword. This file is expected to
208-
contain a list of usersthat this record pertains to, and
209-
optionally alternative passwords.
208+
contain a list of userswho may connect using this record,
209+
andoptionally alternative passwords for them.
210210
</para>
211211

212212
<para>
@@ -224,9 +224,14 @@ hostssl <replaceable>database</replaceable> <replaceable>IP-address</replaceable
224224
Like the <literal>password</literal> method, but the password
225225
is sent over the wire encrypted using a simple
226226
challenge-response protocol. This protects against incidental
227-
wire-sniffing. The name of a file may follow the
227+
wire-sniffing. This is now the recommended choice for
228+
password-based authentication.
229+
</para>
230+
231+
<para>
232+
The name of a file may follow the
228233
<literal>md5</literal> keyword. It contains a list of users
229-
for this record.
234+
who may connect using this record.
230235
</para>
231236
</listitem>
232237
</varlistentry>
@@ -236,9 +241,10 @@ hostssl <replaceable>database</replaceable> <replaceable>IP-address</replaceable
236241
<listitem>
237242
<para>
238243
Like the <literal>md5</literal> method but uses older crypt
239-
authentication for pre-7.2 clients. <literal>md5</literal> is
244+
encryption, which is needed for pre-7.2
245+
clients. <literal>md5</literal> is
240246
preferred for 7.2 and later clients. The <literal>crypt</>
241-
method isalsonot compatible with encrypting passwords in
247+
method is not compatible with encrypting passwords in
242248
<filename>pg_shadow</>, and may fail if client and server
243249
machines have different implementations of the crypt() library
244250
routine.
@@ -333,7 +339,7 @@ hostssl <replaceable>database</replaceable> <replaceable>IP-address</replaceable
333339
<listitem>
334340
<para>
335341
This field is interpreted differently depending on the
336-
authentication method, as describedthere.
342+
authentication method, as describedabove.
337343
</para>
338344
</listitem>
339345
</varlistentry>
@@ -412,6 +418,17 @@ host all 0.0.0.0 0.0.0.0 krb5
412418
# says "bryanh" is allowed to connect as "guest1":
413419

414420
host all 192.168.0.0 255.255.0.0 ident omicron
421+
422+
# If these are the only two lines for local connections, they will allow
423+
# local users to connect only to their own databases (database named the
424+
# same as the user name), except for administrators who may connect to
425+
# all databases. The file $PGDATA/admins lists the user names who are
426+
# permitted to connect to all databases. Passwords are required in all
427+
# cases. (If you prefer to use ident authorization, an ident map can
428+
# serve a parallel purpose to the password list file used here.)
429+
430+
local sameuser md5
431+
local all md5 admins
415432
</programlisting>
416433
</example>
417434
</para>
@@ -434,7 +451,7 @@ host all 192.168.0.0 255.255.0.0 ident omicron
434451
</indexterm>
435452

436453
<para>
437-
<productname>Postgres</> database passwords are separate from any
454+
<productname>Postgres</> database passwords are separate from
438455
operating system user passwords. Ordinarily, the password for each
439456
database user is stored in the pg_shadow system catalog table.
440457
Passwords can be managed with the query language commands
@@ -453,8 +470,8 @@ host all 192.168.0.0 255.255.0.0 ident omicron
453470
<literal>password</>, <literal>md5</>, or <literal>crypt</> keyword,
454471
respectively, in <filename>pg_hba.conf</>. If you do not use this
455472
feature, then any user that is known to the database system can
456-
connect to any database (so long as hepassespassword
457-
authentication,of course).
473+
connect to any database (so long as hesupplies the correctpassword,
474+
of course).
458475
</para>
459476

460477
<para>
@@ -492,8 +509,8 @@ host all 192.168.0.0 255.255.0.0 ident omicron
492509
<para>
493510
Note that using alternative passwords like this means that one can
494511
no longer use <command>ALTER USER</command> to change one's
495-
password. It willstillappear to work but the password one is
496-
actuallychanging is not the password that the system will end up
512+
password. It will appear to work but the password one is
513+
changing is not the password that the system will end up
497514
using.
498515
</para>
499516

‎src/backend/libpq/pg_hba.conf.sample‎

Lines changed: 39 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,13 @@
1616
# Blank lines are ignored. A record consists of tokens separated by
1717
# multiple spaces or tabs.
1818
#
19+
# Each record specifies the authentication method to be used for connections
20+
# of a certain type that match a certain set of IP addresses (if relevant
21+
# for the connection type) and a certain database or databases. The
22+
# postmaster finds the first record that matches the connection type,
23+
# client address, and database name, and uses that record to perform client
24+
# authentication. If no record matches, the connection is rejected.
25+
#
1926
# The first token of a record indicates its type. The remainder of the
2027
# record is interpreted based on its type.
2128
#
@@ -30,7 +37,7 @@
3037
# host
3138
# ----
3239
#
33-
# This record identifiesthenetworked hosts that are permitted to connect
40+
# This record identifies networked hosts that are permitted to connect
3441
# via IP connections.
3542
#
3643
# Format:
@@ -48,12 +55,7 @@
4855
# domain or host names.
4956
#
5057
# AUTH_TYPE and AUTH_ARGUMENT are described below.
51-
#
52-
# There can be multiple "host" records, possibly with overlapping sets of
53-
# host addresses. The postmaster finds the first entry that matches the
54-
# connecting host IP address and the requested database name. If no entry
55-
# matches the database/hostname combination, the connection is rejected.
56-
#
58+
#
5759
#
5860
# hostssl
5961
# -------
@@ -62,8 +64,8 @@
6264
#
6365
# This record identifies a set of network hosts that are permitted to
6466
# connect to databases over secure SSL IP connections. Note that a "host"
65-
# record will also allow SSL connections. "hostssl"forces these
66-
#hosts to use *only*SSL-secured connections.
67+
# record will also allow SSL connections. "hostssl"matches *only*
68+
# SSL-secured connections.
6769
#
6870
# This keyword is only available if the server was compiled with SSL
6971
# support enabled.
@@ -81,10 +83,7 @@
8183
#
8284
# This format is identical to the "host" record type except the IP_ADDRESS
8385
# and ADDRESS_MASK fields are omitted.
84-
#
85-
# As with "host" records, the first "local" record matching the requested
86-
# database name is used.
87-
#
86+
#
8887
#
8988
#
9089
# Authentication Types (AUTH_TYPE)
@@ -105,24 +104,26 @@
105104
#
106105
# If AUTH_ARGUMENT is specified, the username is looked up
107106
# in that file in the $PGDATA directory. If the username
108-
#exists but there is no password, the password is looked
107+
#is found but there is no password, the password is looked
109108
# up in pg_shadow. If a password exists in the file, it is
110-
#itused instead. These secondary files allow fine-grained
109+
# used instead. These secondary files allow fine-grained
111110
# control over who can access which databases and whether
112-
# a non-defaultpasswords are required. The same file can be
111+
# a non-defaultpassword is required. The same file can be
113112
# used in multiple records for easier administration.
114113
# Password files can be maintained with the pg_passwd(1)
115114
# utility. Remember, these passwords override pg_shadow
116115
# passwords.
117116
#
118-
# md5: Same as "password", but authentication is done by
119-
#encrypting the password sent over the network. This is
120-
#always preferable to "password" except for pre-7.2 clients
121-
#that don't support it. Also, md5 can use usernames stored
122-
#in secondary password files but not passwords stored there.
117+
# md5: Same as "password", but the password is encrypted while
118+
#being sent over the network. This method is preferable to
119+
#"password" except for pre-7.2 clients that don't support it.
120+
#NOTE: md5 can use usernames stored in secondary password
121+
#files but ignores passwords stored there. The pg_shadow
122+
#password will always be used.
123123
#
124124
# crypt: Same as "md5", but uses crypt for pre-7.2 clients. You can
125-
#not store encrypted passwords if you use this option.
125+
#not store encrypted passwords in pg_shadow if you use this
126+
#method.
126127
#
127128
# ident:For TCP/IP connections, authentication is done by contacting
128129
#the ident server on the client host. Remember, this is
@@ -168,7 +169,7 @@
168169
# TYPE DATABASE IP_ADDRESS MASK AUTH_TYPE AUTH_ARGUMENT
169170
# local all trust
170171
#
171-
# The same usingIP connections on the same machine:
172+
# The same usinglocal loopback IP connections:
172173
# TYPE DATABASE IP_ADDRESS MASK AUTH_TYPE AUTH_ARGUMENT
173174
# host all 127.0.0.1 255.255.255.255 trust
174175
#
@@ -204,14 +205,28 @@
204205
#
205206
# TYPE DATABASE IP_ADDRESS MASK AUTH_TYPE AUTH_ARGUMENT
206207
# host all 192.168.0.0 255.255.0.0 ident phoenix
208+
#
209+
# If these are the only two lines for local connections, they will allow
210+
# local users to connect only to their own databases (database named the
211+
# same as the user name), except for administrators who may connect to
212+
# all databases. The file $PGDATA/admins lists the user names who are
213+
# permitted to connect to all databases. Passwords are required in all
214+
# cases. (If you prefer to use ident authorization, an ident map can
215+
# serve a parallel purpose to the password list file used here.)
216+
#
217+
# TYPE DATABASE IP_ADDRESS MASK AUTH_TYPE AUTH_ARGUMENT
218+
# local sameuser md5
219+
# local all md5 admins
207220
#
208221
# See $PGDATA/pg_ident.conf for more information on Ident maps.
222+
#
223+
#
209224
#
210225
# Put your actual configuration here
211226
# ==================================
212227
#
213228
# This default configuration allows any local user to connect with any
214-
# PostgreSQL username, over either UNIX domain sockets or IP:
229+
# PostgreSQL username, over either UNIX domain sockets or IP.
215230
#
216231
# If you want to allow non-local connections, you will need to add more
217232
# "host" records. Also, remember IP connections are only enabled if you

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp