Index: doc/src/sgml/backup.sgml
===================================================================
RCS file: /projects/cvsroot/pgsql-server/doc/src/sgml/backup.sgml,v
retrieving revision 2.39
diff -c -r2.39 backup.sgml
*** doc/src/sgml/backup.sgml	22 Apr 2004 07:02:35 -0000	2.39
--- doc/src/sgml/backup.sgml	16 Jul 2004 16:22:24 -0000
***************
*** 437,443 ****
  mv /usr/local/pgsql /usr/local/pgsql.old
  cd ~/postgresql-&version;
  gmake install
! initdb -D /usr/local/pgsql/data
  postmaster -D /usr/local/pgsql/data
  psql template1 < backup
  </programlisting>
--- 437,443 ----
  mv /usr/local/pgsql /usr/local/pgsql.old
  cd ~/postgresql-&version;
  gmake install
! initdb -W -D /usr/local/pgsql/data
  postmaster -D /usr/local/pgsql/data
  psql template1 < backup
  </programlisting>
Index: doc/src/sgml/installation.sgml
===================================================================
RCS file: /projects/cvsroot/pgsql-server/doc/src/sgml/installation.sgml,v
retrieving revision 1.203
diff -c -r1.203 installation.sgml
*** doc/src/sgml/installation.sgml	20 Jun 2004 01:32:46 -0000	1.203
--- doc/src/sgml/installation.sgml	16 Jul 2004 16:25:39 -0000
***************
*** 28,34 ****
  mkdir /usr/local/pgsql/data
  chown postgres /usr/local/pgsql/data
  su - postgres
! /usr/local/pgsql/bin/initdb -D /usr/local/pgsql/data
  /usr/local/pgsql/bin/postmaster -D /usr/local/pgsql/data &gt;logfile 2&gt;&amp;1 &amp;
  /usr/local/pgsql/bin/createdb test
  /usr/local/pgsql/bin/psql test
--- 28,34 ----
  mkdir /usr/local/pgsql/data
  chown postgres /usr/local/pgsql/data
  su - postgres
! /usr/local/pgsql/bin/initdb -W -D /usr/local/pgsql/data
  /usr/local/pgsql/bin/postmaster -D /usr/local/pgsql/data &gt;logfile 2&gt;&amp;1 &amp;
  /usr/local/pgsql/bin/createdb test
  /usr/local/pgsql/bin/psql test
***************
*** 424,430 ****
     these commands while logged in to the special database user account
     (which you already have if you are upgrading).
  <programlisting>
! <userinput>/usr/local/pgsql/bin/initdb -D /usr/local/pgsql/data</>
  <userinput>/usr/local/pgsql/bin/postmaster -D /usr/local/pgsql/data</>
  </programlisting>
     Finally, restore your data with
--- 424,430 ----
     these commands while logged in to the special database user account
     (which you already have if you are upgrading).
  <programlisting>
! <userinput>/usr/local/pgsql/bin/initdb -W -D /usr/local/pgsql/data</>
  <userinput>/usr/local/pgsql/bin/postmaster -D /usr/local/pgsql/data</>
  </programlisting>
     Finally, restore your data with
***************
*** 1305,1311 ****
  root# <userinput>mkdir /usr/local/pgsql/data</>
  root# <userinput>chown postgres /usr/local/pgsql/data</>
  root# <userinput>su - postgres</>
! postgres$ <userinput>/usr/local/pgsql/bin/initdb -D /usr/local/pgsql/data</>
  </screen>
      </para>
  
--- 1305,1311 ----
  root# <userinput>mkdir /usr/local/pgsql/data</>
  root# <userinput>chown postgres /usr/local/pgsql/data</>
  root# <userinput>su - postgres</>
! postgres$ <userinput>/usr/local/pgsql/bin/initdb -W -D /usr/local/pgsql/data</>
  </screen>
      </para>
  
***************
*** 1317,1322 ****
--- 1317,1329 ----
       doesn't already exist) before starting <command>initdb</>, as
       illustrated here.
      </para>
+
+     <para>
+      The <option>-W</> option configures the server for password
+      authentication for local connections. Other options are available
+      for different authentication methods. See <xref 
+      linkend="client-authentication"> for details.
+     </para>
     </step>
  
     <step>
Index: doc/src/sgml/runtime.sgml
===================================================================
RCS file: /projects/cvsroot/pgsql-server/doc/src/sgml/runtime.sgml,v
retrieving revision 1.269
diff -c -r1.269 runtime.sgml
*** doc/src/sgml/runtime.sgml	11 Jul 2004 00:18:40 -0000	1.269
--- doc/src/sgml/runtime.sgml	16 Jul 2004 16:30:34 -0000
***************
*** 74,80 ****
     file system location of your database system is indicated by the
     <option>-D</option> option, for example
  <screen>
! <prompt>$</> <userinput>initdb -D /usr/local/pgsql/data</userinput>
  </screen>
     Note that you must execute this command while logged into the
     <productname>PostgreSQL</productname> user account, which is
--- 74,80 ----
     file system location of your database system is indicated by the
     <option>-D</option> option, for example
  <screen>
! <prompt>$</> <userinput>initdb -W -D /usr/local/pgsql/data</userinput>
  </screen>
     Note that you must execute this command while logged into the
     <productname>PostgreSQL</productname> user account, which is
***************
*** 101,107 ****
  root# <userinput>mkdir /usr/local/pgsql/data</userinput>
  root# <userinput>chown postgres /usr/local/pgsql/data</userinput>
  root# <userinput>su postgres</userinput>
! postgres$ <userinput>initdb -D /usr/local/pgsql/data</userinput>
  </screen>
    </para>
  
--- 101,107 ----
  root# <userinput>mkdir /usr/local/pgsql/data</userinput>
  root# <userinput>chown postgres /usr/local/pgsql/data</userinput>
  root# <userinput>su postgres</userinput>
! postgres$ <userinput>initdb -W -D /usr/local/pgsql/data</userinput>
  </screen>
    </para>
  
***************
*** 119,137 ****
  
    <para>
     However, while the directory contents are secure, the default
!    client authentication setup allows any local user to connect to the
!    database and even become the database superuser. If you do not
!    trust other local users, we recommend you use one of
!    <command>initdb</command>'s <option>-W</option>, <option>--pwprompt</option>
!    or <option>--pwfile</option> option to assign a password to the
!    database superuser.<indexterm><primary>password</><secondary>of the
!    superuser</></indexterm> After <command>initdb</command>, modify
!    the <filename>pg_hba.conf</filename> file to use <literal>md5</> or
!    <literal>password</> instead of <literal>trust</> authentication
!    <emphasis>before</> you start the server for the first time. (Other
!    approaches include using <literal>ident</literal> authentication or
!    file system permissions to restrict connections. See <xref
!    linkend="client-authentication"> for more information.)
    </para>
  
    <para>
--- 119,131 ----
  
    <para>
     However, while the directory contents are secure, the default
!    client authentication setup depends on which authentication parameter
!    you pass to initdb. With <xref linkend="auth-trust"> all other local
!    users can connect to any database and even become the database
!    superuser, regardless of the directory security. If you do not
!    trust other local users, we recommend you use a different
!    authentication method. See <xref linkend="client-authentication">
!    for more information.
    </para>
  
    <para>
Index: doc/src/sgml/ref/initdb.sgml
===================================================================
RCS file: /projects/cvsroot/pgsql-server/doc/src/sgml/ref/initdb.sgml,v
retrieving revision 1.31
diff -c -r1.31 initdb.sgml
*** doc/src/sgml/ref/initdb.sgml	14 Jul 2004 17:55:09 -0000	1.31
--- doc/src/sgml/ref/initdb.sgml	16 Jul 2004 16:02:52 -0000
***************
*** 24,29 ****
--- 24,36 ----
     <command>initdb</command>
     <arg rep="repeat"><replaceable>option</></arg>
     <group choice="plain">
+     <arg>-W </arg>
+     <arg>--pwprompt </arg>
+     <arg>--pwfile </arg>
+     <arg>--ident </arg>
+     <arg>--trust </arg>
+    </group>
+    <group choice="plain">
      <arg>--pgdata </arg>
      <arg>-D </arg>
      <replaceable>directory</replaceable>
***************
*** 91,96 ****
--- 98,111 ----
     <command>su</command> to become the database user, and
     finally run <command>initdb</command> as the database user.
    </para>
+
+   <para>
+    <command>initdb</command> will set up the database cluster with access
+    only from the local machine (over both unix domain sockets, where
+    available, and TCP/IP), with the specified authentication method 
+    (password, ident or trust). For information about the different
+    available authentication methods, see <xref linkend="auth-methods">.
+   </para>
   </refsect1>

   <refsect1>
***************
*** 177,187 ****
        <term><option>--pwprompt</option></term>
        <listitem>
         <para>
!         Makes <command>initdb</command> prompt for a password
!         to give the database superuser. If you don't plan on using password
!         authentication, this is not important.  Otherwise you won't be
!         able to use password authentication until you have a password
!         set up.
         </para>
        </listitem>
       </varlistentry>
--- 192,200 ----
        <term><option>--pwprompt</option></term>
        <listitem>
         <para>
!         Makes <command>initdb</command> set the default authentication to
!         <xref linkend="auth-password"> and prompt for a password
!         to give the database superuser.
         </para>
        </listitem>
       </varlistentry>
***************
*** 190,197 ****
        <term><option>--pwfile=<replaceable>filename</></option></term>
        <listitem>
         <para>
!         Makes <command>initdb</command> read the database superuser's password
!         from a file.  The first line of the file is taken as the password.
         </para>
        </listitem>
       </varlistentry>
--- 203,232 ----
        <term><option>--pwfile=<replaceable>filename</></option></term>
        <listitem>
         <para>
!         Makes <command>initdb</command> set the default authentication to
!         <xref linkend="auth-password"> and read the database superuser's
!         password from a file.  The first line of the file is taken as the
!         password.
!        </para>
!       </listitem>
!      </varlistentry>
!
!      <varlistentry>
!       <term><option>--ident</option></term>
!       <listitem>
!        <para>
!        Makes <command>initdb</command> set the default authentication method
!        to <xref linkend="auth-ident">.
!        </para>
!       </listitem>
!      </varlistentry>
!
!      <varlistentry>
!       <term><option>--trust</option></term>
!       <listitem>
!        <para>
!        Makes <command>initdb</command> set the default authentication method
!        to <xref linkend="auth-trust">.
         </para>
        </listitem>
       </varlistentry>
Index: src/backend/libpq/pg_hba.conf.sample
===================================================================
RCS file: /projects/cvsroot/pgsql-server/src/backend/libpq/pg_hba.conf.sample,v
retrieving revision 1.48
diff -c -r1.48 pg_hba.conf.sample
*** src/backend/libpq/pg_hba.conf.sample	25 Dec 2003 03:44:05 -0000	1.48
--- src/backend/libpq/pg_hba.conf.sample	15 Jul 2004 20:45:00 -0000
***************
*** 48,67 ****
  # Put your actual configuration here
  # ----------------------------------
  #
- # CAUTION: The default configuration allows any local user to connect
- # using any PostgreSQL user name, including the superuser, over either
- # Unix-domain sockets or TCP/IP.  If you are on a multiple-user
- # machine, the default configuration is probably too liberal for you.
- # Change it to use something other than "trust" authentication.
- #
  # If you want to allow non-local connections, you need to add more
  # "host" records.  Also, remember TCP/IP connections are only enabled
  # if you enable "tcpip_socket" in postgresql.conf.

  # TYPE  DATABASE    USER        IP-ADDRESS        IP-MASK           METHOD

! local   all         all                                             trust
  # IPv4-style local connections:
! host    all         all         127.0.0.1         255.255.255.255   trust
  # IPv6-style local connections:
! host    all         all         ::1/128                             trust
--- 48,63 ----
  # Put your actual configuration here
  # ----------------------------------
  #
  # If you want to allow non-local connections, you need to add more
  # "host" records.  Also, remember TCP/IP connections are only enabled
  # if you enable "tcpip_socket" in postgresql.conf.

+ @authcomment@
+
  # TYPE  DATABASE    USER        IP-ADDRESS        IP-MASK           METHOD

! local   all         all                                             @authmethod@
  # IPv4-style local connections:
! host    all         all         127.0.0.1         255.255.255.255   @authmethod@
  # IPv6-style local connections:
! host    all         all         ::1/128                             @authmethod@
Index: src/bin/initdb/initdb.c
===================================================================
RCS file: /projects/cvsroot/pgsql-server/src/bin/initdb/initdb.c,v
retrieving revision 1.43
diff -c -r1.43 initdb.c
*** src/bin/initdb/initdb.c	14 Jul 2004 17:55:10 -0000	1.43
--- src/bin/initdb/initdb.c	15 Jul 2004 20:55:53 -0000
***************
*** 88,93 ****
--- 88,95 ----
  char	   *username = "";
  bool		pwprompt = false;
  char       *pwfilename = NULL;
+ bool        identauth = false;
+ bool        trustauth = false;
  bool		debug = false;
  bool		noclean = false;
  bool		show_setting = false;
***************
*** 119,124 ****
--- 121,135 ----
  int			n_buffers = 50;

  /*
+  * Warning messages for authentication methods
+  */
+ char *authtrust_warning =											\
+ 	"# CAUTION: Configuring the system for local \"trust\" authentication allows\n"
+ 	"# any local user to connect as any PostgreSQL user, including the database\n"
+ 	"# superuser. If you do not trust all your local users, use another\n"
+ 	"# authenication method.\n";
+
+ /*
   * Centralized knowledge of switches to pass to backend
   *
   * Note: in the shell-script version, we also passed PGDATA as a -D switch,
***************
*** 1114,1120 ****
  							  "host    all         all         ::1",
  							  "#host    all         all         ::1");
  #endif
!
  	snprintf(path, sizeof(path), "%s/pg_hba.conf", pg_data);

  	writefile(path, conflines);
--- 1125,1141 ----
  							  "host    all         all         ::1",
  							  "#host    all         all         ::1");
  #endif
!
! 	/* Replace default authentication methods */
! 	conflines = replace_token(conflines,
! 							 "@authmethod@",
! 							 (pwprompt || pwfilename)?"md5":
! 							 identauth?"ident":"trust");
!
! 	conflines = replace_token(conflines,
! 							  "@authcomment@",
! 							  trustauth?authtrust_warning:"");
!
  	snprintf(path, sizeof(path), "%s/pg_hba.conf", pg_data);

  	writefile(path, conflines);
***************
*** 1972,1979 ****
  			 "                            environment)\n"));
  	printf(_("  --no-locale               equivalent to --locale=C\n"));
  	printf(_("  -U, --username=NAME       database superuser name\n"));
! 	printf(_("  -W, --pwprompt            prompt for a password for the new superuser\n"));
! 	printf(_("  --pwfile=filename         read password for the new superuser from file\n"));
  	printf(_("  -?, --help                show this help, then exit\n"));
  	printf(_("  -V, --version             output version information, then exit\n"));
  	printf(_("\nLess commonly used options:\n"));
--- 1993,2004 ----
  			 "                            environment)\n"));
  	printf(_("  --no-locale               equivalent to --locale=C\n"));
  	printf(_("  -U, --username=NAME       database superuser name\n"));
! 	printf(_("  -W, --pwprompt            prompt for a password for the new superuser,\n"
! 			 "                            and configure for password authentication\n"));
! 	printf(_("  --pwfile=filename         read password for the new superuser from file,\n"
! 			 "                            and configure for password authentication\n"));
! 	printf(_("  --ident                   configure for ident authentication\n"));
! 	printf(_("  --trust                   configure for trust authentication\n"));
  	printf(_("  -?, --help                show this help, then exit\n"));
  	printf(_("  -V, --version             output version information, then exit\n"));
  	printf(_("\nLess commonly used options:\n"));
***************
*** 2006,2011 ****
--- 2031,2038 ----
  		{"no-locale", no_argument, NULL, 8},
  		{"pwprompt", no_argument, NULL, 'W'},
  		{"pwfile", required_argument, NULL, 9},
+ 		{"ident", no_argument, NULL, 10},
+ 		{"trust", no_argument, NULL, 11},
  		{"username", required_argument, NULL, 'U'},
  		{"help", no_argument, NULL, '?'},
  		{"version", no_argument, NULL, 'V'},
***************
*** 2098,2103 ****
--- 2125,2136 ----
  			case 9:
  				pwfilename = xstrdup(optarg);
  				break;
+ 			case 10:
+ 				identauth = true;
+ 				break;
+ 			case 11:
+ 				trustauth = true;
+ 				break;
  			case 's':
  				show_setting = true;
  				break;
***************
*** 2128,2133 ****
--- 2161,2181 ----
  		fprintf(stderr, _("%s: you cannot specify both password prompt and password file\n"), progname);
  		exit(1);
  	}
+
+ 	if (!(pwprompt || pwfilename || identauth || trustauth))
+ 	{
+ 		fprintf(stderr, _("%s: no authentication method specified. You must specify password, ident or trust authentication\n"),progname);
+ 		exit(1);
+ 	}
+
+ 	if ( (pwprompt?1:0) +
+ 		 (pwfilename?1:0) +
+ 		 (identauth?1:0) +
+ 		 (trustauth?1:0) > 1)
+ 	{
+ 		fprintf(stderr, _("%s: you cannot specify more than one authentication method\n"),progname);
+ 		exit(1);
+ 	}

  	if (strlen(pg_data) == 0)
  	{