database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-30 11:03:19 +03:00
Code Activity

initdb: Change authentication defaults

Browse Source 
Change the defaults for the pg_hba.conf generated by initdb to "peer"
for local (if supported, else "md5") and "md5" for host.

(Changing from "md5" to SCRAM is left as a separate exercise.)

"peer" is currently not supported on AIX, HP-UX, and Windows.  Users
on those operating systems will now either have to provide a password
to initdb or choose a different authentication method when running
initdb.

Reviewed-by: Julien Rouhaud <rjuju123@gmail.com>
Discussion: https://www.postgresql.org/message-id/flat/bec17f0a-ddb1-8b95-5e69-368d9d0a3390%40postgresql.org
This commit is contained in:
Peter Eisentraut
2019-07-22 14:40:55 +02:00
parent 1e6a759838
commit 09f08930f0
6 changed files with 41 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
src/bin/initdb/initdb.c
View File

@ -185,7 +185,6 @@ static const char *default_timezone = NULL;
"# allows any local user to connect as any PostgreSQL user, including\n" \
"# the database superuser. If you do not trust all your local users,\n" \
"# use another authentication method.\n"
static bool authwarning = false;
/*
* Centralized knowledge of switches to pass to backend
@ -2391,16 +2390,6 @@ usage(const char *progname)
printf(_("\nReport bugs to <pgsql-bugs@lists.postgresql.org>.\n"));
}
static void
check_authmethod_unspecified(const char **authmethod)
{
if (*authmethod == NULL)
{
authwarning = true;
*authmethod = "trust";
}
}
static void
check_authmethod_valid(const char *authmethod, const char *const *valid_methods, const char *conntype)
{
@ -3248,8 +3237,16 @@ main(int argc, char *argv[])
exit(1);
}
check_authmethod_unspecified(&authmethodlocal);
check_authmethod_unspecified(&authmethodhost);
if (authmethodlocal == NULL)
{
#ifdef HAVE_AUTH_PEER
authmethodlocal = "peer";
#else
authmethodlocal = "md5";
#endif
}
if (authmethodhost == NULL)
authmethodhost = "md5";
check_authmethod_valid(authmethodlocal, auth_methods_local, "local");
check_authmethod_valid(authmethodhost, auth_methods_host, "host");
@ -3332,14 +3329,6 @@ main(int argc, char *argv[])
else
printf(_("\nSync to disk skipped.\nThe data directory might become corrupt if the operating system crashes.\n"));
if (authwarning)
{
printf("\n");
pg_log_warning("enabling \"trust\" authentication for local connections");
fprintf(stderr, _("You can change this by editing pg_hba.conf or using the option -A, or\n"
"--auth-local and --auth-host, the next time you run initdb.\n"));
}
/*
* Build up a shell command to tell the user how to start the server
*/

5
src/include/port.h
View File

@ -361,6 +361,11 @@ extern int fls(int mask);
extern int getpeereid(int sock, uid_t *uid, gid_t *gid);
#endif
/* must match src/port/getpeereid.c */
#if defined(HAVE_GETPEEREID) || defined(SO_PEERCRED) || defined(LOCAL_PEERCRED) || defined(HAVE_GETPEERUCRED)
#define HAVE_AUTH_PEER 1
#endif
#ifndef HAVE_ISINF
extern int isinf(double x);
#else

2
src/test/regress/pg_regress.c
View File

@ -2302,7 +2302,7 @@ regression_main(int argc, char *argv[], init_function ifunc, test_function tfunc
/* initdb */
header(_("initializing database system"));
snprintf(buf, sizeof(buf),
"\"%s%sinitdb\" -D \"%s/data\" --no-clean --no-sync%s%s > \"%s/log/initdb.log\" 2>&1",
"\"%s%sinitdb\" -D \"%s/data\" -A trust --no-clean --no-sync%s%s > \"%s/log/initdb.log\" 2>&1",
bindir ? bindir : "",
bindir ? "/" : "",
temp_instance,