Sorry about the lack of quoting, but please don't post HTML mail if
possible. Comments below
"Anthony Metzidis" <metzidis@mednet.ucla.edu> wrote in message
news:97m43u$2ec0$1@news.tht.net...
Hi,
When I 'CREATE USER testuser WITH PASSWORD 'mypassword';
I see an entry in PG_PWD with the password 'mypassword' in plaintext.
--RH--
The pg_pwd file should be owned by user postgres and have a mode of 0600 so
only readable by postgres. Only root or postgres can read this file.
------
In my pg_hba.conf I have all hosts using 'password' authentication with no
file argument. Is there any way to keep postgres from saving the passwords
in plain text? This seems to be a huge security hole. I thought that
passwords were to be saved in PG_SHADOW. What is PG_SHADOW for anyway?
--RH--
If you are talking about the pg_shadow table, the permissions on it should
only let user postgres access it, not common users.
Since you don't say otherwise I assume you're using default authentication
which sends passwords over the wire in cleartext - if you're worrying, I'd
worry about that.
If someone has compromised the postgres account on your database server,
they've got access to all your databases anyway.
For more details read the section on client authentication in the
administrator's manual. Loads of details there.
- Richard Huxton
