Thread: Security Questions of PostgreSQL

Security Questions of PostgreSQL

From
Gordon Yuen
Date:
Dear folks,

    I have two questions:

1. Can anyone find a way to let user alter the their own password,
instead of altered by database super user? I use 'password' option in
'pg_hba.conf', then I find the pg_shadow table is only altered by super
user 'postgres'. Then I tried 'password pg_passwd.txt', but the
executable 'pg_passwd' could only be executed by 'postgres' or 'root'.
What gives?

2. I understand that an ODBC client send the username/password in clear
text via network for authentication, am I wrong? How can be secured?

Gordon