hubert baumgartner <hubert_baumgartner@mac.com> writes:
> i have a few security concerns about postgres database and would like
> to know if there is a possibility to compile postgres a way he only
> accepts password athentication , and ignores the pg_hba.conf file ....
> any ideas ?
I suppose you could rip all the auth methods except password out of the
code ... but I cannot imagine a more complete waste of time. If someone
has write access to the pg_hba.conf file, then they have already broken
into your postgres account or your root account. The game is over;
there isn't anything in your database that they can't read, change, or
delete. Even more to the point, there's nothing stopping them from
changing all the database passwords. What makes you think that password
authentication is one iota more secure than any other method, under
such conditions?
regards, tom lane
