Index: src/bin/initdb/initdb.c =================================================================== RCS file: /projects/cvsroot/pgsql-server/src/bin/initdb/initdb.c,v retrieving revision 1.43 diff -c -r1.43 initdb.c *** src/bin/initdb/initdb.c 14 Jul 2004 17:55:10 -0000 1.43 --- src/bin/initdb/initdb.c 15 Jul 2004 20:55:53 -0000 *************** *** 88,93 **** --- 88,95 ---- char *username = ""; bool pwprompt = false; char *pwfilename = NULL; + bool identauth = false; + bool trustauth = false; bool debug = false; bool noclean = false; bool show_setting = false; *************** *** 119,124 **** --- 121,135 ---- int n_buffers = 50; /* + * Warning messages for authentication methods + */ + char *authtrust_warning = \ + "# CAUTION: Configuring the system for local \"trust\" authentication allows\n" + "# any local user to connect as any PostgreSQL user, including the database\n" + "# superuser. If you do not trust all your local users, use another\n" + "# authenication method.\n"; + + /* * Centralized knowledge of switches to pass to backend * * Note: in the shell-script version, we also passed PGDATA as a -D switch, *************** *** 1114,1120 **** "host all all ::1", "#host all all ::1"); #endif ! snprintf(path, sizeof(path), "%s/pg_hba.conf", pg_data); writefile(path, conflines); --- 1125,1141 ---- "host all all ::1", "#host all all ::1"); #endif ! ! /* Replace default authentication methods */ ! conflines = replace_token(conflines, ! "@authmethod@", ! (pwprompt || pwfilename)?"md5": ! identauth?"ident":"trust"); ! ! conflines = replace_token(conflines, ! "@authcomment@", ! trustauth?authtrust_warning:""); ! snprintf(path, sizeof(path), "%s/pg_hba.conf", pg_data); writefile(path, conflines); *************** *** 1972,1979 **** " environment)\n")); printf(_(" --no-locale equivalent to --locale=C\n")); printf(_(" -U, --username=NAME database superuser name\n")); ! printf(_(" -W, --pwprompt prompt for a password for the new superuser\n")); ! printf(_(" --pwfile=filename read password for the new superuser from file\n")); printf(_(" -?, --help show this help, then exit\n")); printf(_(" -V, --version output version information, then exit\n")); printf(_("\nLess commonly used options:\n")); --- 1993,2004 ---- " environment)\n")); printf(_(" --no-locale equivalent to --locale=C\n")); printf(_(" -U, --username=NAME database superuser name\n")); ! printf(_(" -W, --pwprompt prompt for a password for the new superuser,\n" ! " and configure for password authentication\n")); ! printf(_(" --pwfile=filename read password for the new superuser from file,\n" ! " and configure for password authentication\n")); ! printf(_(" --ident configure for ident authentication\n")); ! printf(_(" --trust configure for trust authentication\n")); printf(_(" -?, --help show this help, then exit\n")); printf(_(" -V, --version output version information, then exit\n")); printf(_("\nLess commonly used options:\n")); *************** *** 2006,2011 **** --- 2031,2038 ---- {"no-locale", no_argument, NULL, 8}, {"pwprompt", no_argument, NULL, 'W'}, {"pwfile", required_argument, NULL, 9}, + {"ident", no_argument, NULL, 10}, + {"trust", no_argument, NULL, 11}, {"username", required_argument, NULL, 'U'}, {"help", no_argument, NULL, '?'}, {"version", no_argument, NULL, 'V'}, *************** *** 2098,2103 **** --- 2125,2136 ---- case 9: pwfilename = xstrdup(optarg); break; + case 10: + identauth = true; + break; + case 11: + trustauth = true; + break; case 's': show_setting = true; break; *************** *** 2128,2133 **** --- 2161,2181 ---- fprintf(stderr, _("%s: you cannot specify both password prompt and password file\n"), progname); exit(1); } + + if (!(pwprompt || pwfilename || identauth || trustauth)) + { + fprintf(stderr, _("%s: no authentication method specified. You must specify password, ident or trust authentication\n"),progname); + exit(1); + } + + if ( (pwprompt?1:0) + + (pwfilename?1:0) + + (identauth?1:0) + + (trustauth?1:0) > 1) + { + fprintf(stderr, _("%s: you cannot specify more than one authentication method\n"),progname); + exit(1); + } if (strlen(pg_data) == 0) { Index: src/backend/libpq/pg_hba.conf.sample =================================================================== RCS file: /projects/cvsroot/pgsql-server/src/backend/libpq/pg_hba.conf.sample,v retrieving revision 1.48 diff -c -r1.48 pg_hba.conf.sample *** src/backend/libpq/pg_hba.conf.sample 25 Dec 2003 03:44:05 -0000 1.48 --- src/backend/libpq/pg_hba.conf.sample 15 Jul 2004 20:45:00 -0000 *************** *** 48,67 **** # Put your actual configuration here # ---------------------------------- # - # CAUTION: The default configuration allows any local user to connect - # using any PostgreSQL user name, including the superuser, over either - # Unix-domain sockets or TCP/IP. If you are on a multiple-user - # machine, the default configuration is probably too liberal for you. - # Change it to use something other than "trust" authentication. - # # If you want to allow non-local connections, you need to add more # "host" records. Also, remember TCP/IP connections are only enabled # if you enable "tcpip_socket" in postgresql.conf. # TYPE DATABASE USER IP-ADDRESS IP-MASK METHOD ! local all all trust # IPv4-style local connections: ! host all all 127.0.0.1 255.255.255.255 trust # IPv6-style local connections: ! host all all ::1/128 trust --- 48,63 ---- # Put your actual configuration here # ---------------------------------- # # If you want to allow non-local connections, you need to add more # "host" records. Also, remember TCP/IP connections are only enabled # if you enable "tcpip_socket" in postgresql.conf. + @authcomment@ + # TYPE DATABASE USER IP-ADDRESS IP-MASK METHOD ! local all all @authmethod@ # IPv4-style local connections: ! host all all 127.0.0.1 255.255.255.255 @authmethod@ # IPv6-style local connections: ! host all all ::1/128 @authmethod@