Solved! Trying to secure PostgreSQL

[Kirk Strauser]

At 2003-09-12T23:28:41Z, "Andrew L. Gould" <algould at datawok.com> writes:

> You might be interested in 'ident same' or some other combination of
> options.

That was exactly what I needed - thanks!

My pg_hba.conf now looks like:

    local   all         pgsql                                           ident    sameuser
    local   all         all                                             ident    webusers
    host    all         all         127.0.0.1         255.255.255.255   md5
    host    all         all         10.0.5.16         255.255.255.255   md5

This enforces password authing on the appropriate network interfaces.

For local connections, user `pgsql' can connect as that username, but no
other user can connect as `pgsql', and `pgsql' can't connect as any other
other.

Other users can connect locally if and only if they are defined in the
`webusers' map in pg_ident.conf.

That was the biggest part of my intended security overhaul.  Now I want to
prevent users from seeing databases that they're not authorized to access,
but since they can't connect to them anyway, I'm not nearly as concerned
about that.

Thanks again to all who helped!
-- 
Kirk Strauser
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 188 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20030912/494d51e8/attachment.bin