Re: Is "trust" really a good default? - Mailing list pgsql-hackers

From Tom Lane
Subject Re: Is "trust" really a good default?
Date
Msg-id 18843.1089754027@sss.pgh.pa.us
Whole thread Raw
In response to Re: Is "trust" really a good default?  (Bruce Momjian <pgman@candle.pha.pa.us>)
Responses Re: Is "trust" really a good default?  (Oliver Elphick <olly@lfix.co.uk>)
List pgsql-hackers
Bruce Momjian <pgman@candle.pha.pa.us> writes:
> Magnus Hagander wrote:
>> Might still be worth adding "--ident" as a parameter anyway, but in that
>> case only to help the distros that need it. Or not, because they already
>> have a way to deal with it.

> I think --ident would be very helpful, and we know with OS's support
> ident too.

If we're going to be doing sed-like substitutions on pg_hba.conf.sample,
then we really really wanna discourage distros from hacking the sample
file directly, because that could break the sed results.  So I think
it's important to provide the switch.

I was toying with the notion of a different editing mechanism though,
so that initdb could emit a pg_hba.conf containing comments that are
actually pertinent to the selected behavior.  One simple way would be to
prefix each line with a keyword to select when to emit it:
    ALWAYS this text is always emitted
    NEVER  this text is never emitted (a meta-comment)
    TRUST  this text is emitted if we're selecting TRUST mode
    IDENT  this text is emitted if we're selecting IDENT mode
    etc.

            regards, tom lane

pgsql-hackers by date:

Previous
From: "Magnus Hagander"
Date:
Subject: Re: Is "trust" really a good default?
Next
From: Lamar Owen
Date:
Subject: Re: Release planning (was: Re: Status report)