Re: GSSAPI, SSPI - include_realm default - Mailing list pgsql-hackers

From Stephen Frost
Subject Re: GSSAPI, SSPI - include_realm default
Date
Msg-id 20150508234554.GE30322@tamriel.snowman.net
Whole thread Raw
In response to Re: GSSAPI, SSPI - include_realm default  (Bruce Momjian <bruce@momjian.us>)
List pgsql-hackers
Bruce,

* Bruce Momjian (bruce@momjian.us) wrote:
> On Tue, Dec  9, 2014 at 05:38:25PM -0500, Stephen Frost wrote:
> > > My comment that include_realm is supported back to 8.4 was because there
> > > is an expectation that a pg_hba.conf file can be used unchanged across
> > > several major releases.  So when 9.5 comes out and people update their
> > > pg_hba.conf files for 9.5, those files will still work in old releases.
> > >  But the time to do those updates is then, not now.
> >
> > The back-branches are being patched to discourage using the default
> > because it's not a secure approach.  New users start using PG all the
> > time and so changing the existing documentation is worthwhile to ensure
> > those new users understand.  A note in the release notes for whichever
> > minor release the change to the documentation shows up in would be a
> > good way to make existing users aware of the change and hopefully
> > encourage them to review their configuration.
> >
> > If we don't agree that the change should be made then we can discuss
> > that, but everyone commenting so far has agreed on the change.
>
> Where are we on this?

Thanks for the prod on this.  I've now committed the changes which were
discussed.  Please let me know if you see any issues or have any
concerns.
Thanks again!
    Stephen

pgsql-hackers by date:

Previous
From: Andres Freund
Date:
Subject: Re: initdb -S and tablespaces
Next
From: Andres Freund
Date:
Subject: Re: a fast bloat measurement tool (was Re: Measuring relation free space)