diff --git a/configure b/configure new file mode 100755 index 7c0bd0c..bd80b46 *** a/configure --- b/configure *************** with_tcl *** 824,829 **** --- 824,831 ---- with_tclconfig with_perl with_python + with_trust_auth + with_ident_auth with_gssapi with_krb_srvnam with_pam *************** Optional Packages: *** 1511,1516 **** --- 1513,1520 ---- --with-tclconfig=DIR tclConfig.sh is in DIR --with-perl build Perl modules (PL/Perl) --with-python build Python modules (PL/Python) + --without-trust-auth build with trust authentication support + --without-ident-auth build with ident authentication support --with-gssapi build with GSSAPI support --with-krb-srvnam=NAME default service principal name in Kerberos (GSSAPI) [postgres] *************** $as_echo "$with_python" >&6; } *** 5414,5419 **** --- 5418,5505 ---- # + # Enable Trust authentication + # + + { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to build with trust authentication support" >&5 + $as_echo_n "checking whether to build with trust authentication support... " >&6; } + + + + # Check whether --with-trust-auth was given. + if test "${with_trust_auth+set}" = set; then : + withval=$with_trust_auth; + case $withval in + yes) + + + $as_echo "#define WITH_TRUST 1" >>confdefs.h + + + ;; + no) + : + ;; + *) + as_fn_error $? "no argument expected for --with-trust-auth option" "$LINENO" 5 + ;; + esac + + else + with_trust_auth=yes + + + $as_echo "#define WITH_TRUST 1" >>confdefs.h + + + fi + + + { $as_echo "$as_me:${as_lineno-$LINENO}: result: $with_trust_auth" >&5 + $as_echo "$with_trust_auth" >&6; } + + # + # Enable Ident authentication + # + + { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to build with ident authentication support" >&5 + $as_echo_n "checking whether to build with ident authentication support... " >&6; } + + + + # Check whether --with-ident-auth was given. + if test "${with_ident_auth+set}" = set; then : + withval=$with_ident_auth; + case $withval in + yes) + + + $as_echo "#define WITH_IDENT 1" >>confdefs.h + + + ;; + no) + : + ;; + *) + as_fn_error $? "no argument expected for --with-ident-auth option" "$LINENO" 5 + ;; + esac + + else + with_ident_auth=yes + + + $as_echo "#define WITH_IDENT 1" >>confdefs.h + + + fi + + + { $as_echo "$as_me:${as_lineno-$LINENO}: result: $with_ident_auth" >&5 + $as_echo "$with_ident_auth" >&6; } + + # # GSSAPI # { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to build with GSSAPI support" >&5 diff --git a/configure.in b/configure.in new file mode 100644 index 1cd9e1e..a823571 *** a/configure.in --- b/configure.in *************** AC_MSG_RESULT([$with_python]) *** 626,631 **** --- 626,653 ---- AC_SUBST(with_python) # + # Enable Trust authentication + # + + AC_MSG_CHECKING([whether to build with trust authentication support]) + PGAC_ARG_BOOL(with, trust-auth, yes, [build with trust authentication support], + [ + AC_DEFINE(WITH_TRUST, 1, [Define to build with trust authentication support. (--without-trust-auth)]) + ]) + AC_MSG_RESULT([$with_trust_auth]) + + # + # Enable Ident authentication + # + + AC_MSG_CHECKING([whether to build with ident authentication support]) + PGAC_ARG_BOOL(with, ident-auth, yes, [build with ident authentication support], + [ + AC_DEFINE(WITH_IDENT, 1, [Define to build with ident authentication support. (--without-ident-auth)]) + ]) + AC_MSG_RESULT([$with_ident_auth]) + + # # GSSAPI # AC_MSG_CHECKING([whether to build with GSSAPI support]) diff --git a/doc/src/sgml/installation.sgml b/doc/src/sgml/installation.sgml new file mode 100644 index 4968e09..2a49283 *** a/doc/src/sgml/installation.sgml --- b/doc/src/sgml/installation.sgml *************** su - postgres *** 757,762 **** --- 757,786 ---- + + + + Build without support for trust authentication. Trust authentication + is useful on standalone systems but may lead to serious security + issues when not used properly. This switch disables the trust keyword + in the pg_hba.conf file. + + + + + + + + + Build without support for ident authentication. Ident authentication + is useful for some specific setups but may generally lead to serious security + issues when not used properly. This switch disables the ident keyword + in the pg_hba.conf file. + + + + + diff --git a/src/backend/libpq/hba.c b/src/backend/libpq/hba.c new file mode 100644 index a0f5396..33b5539 *** a/src/backend/libpq/hba.c --- b/src/backend/libpq/hba.c *************** parse_hba_line(List *line, int line_num, *** 1150,1158 **** --- 1150,1166 ---- unsupauth = NULL; if (strcmp(token->string, "trust") == 0) + #ifdef WITH_TRUST parsedline->auth_method = uaTrust; + #else + unsupauth = "trust"; + #endif else if (strcmp(token->string, "ident") == 0) + #ifdef WITH_IDENT parsedline->auth_method = uaIdent; + #else + unsupauth = "ident"; + #endif else if (strcmp(token->string, "peer") == 0) parsedline->auth_method = uaPeer; else if (strcmp(token->string, "password") == 0) diff --git a/src/bin/initdb/initdb.c b/src/bin/initdb/initdb.c new file mode 100644 index 8694920..5541a9c *** a/src/bin/initdb/initdb.c --- b/src/bin/initdb/initdb.c *************** *** 71,77 **** /* Ideally this would be in a .h file, but it hardly seems worth the trouble */ extern const char *select_default_timezone(const char *share_path); ! static const char *auth_methods_host[] = {"trust", "reject", "md5", "password", "ident", "radius", #ifdef ENABLE_GSS "gss", #endif --- 71,85 ---- /* Ideally this would be in a .h file, but it hardly seems worth the trouble */ extern const char *select_default_timezone(const char *share_path); ! static const char *auth_methods_host[] = { ! #ifdef WITH_TRUST ! "trust", ! #endif ! "md5", "reject", "password", ! #ifdef WITH_IDENT ! "ident", ! #endif ! "radius", #ifdef ENABLE_GSS "gss", #endif *************** static const char *auth_methods_host[] = *** 88,94 **** "cert", #endif NULL}; ! static const char *auth_methods_local[] = {"trust", "reject", "md5", "password", "peer", "radius", #ifdef USE_PAM "pam", "pam ", #endif --- 96,106 ---- "cert", #endif NULL}; ! static const char *auth_methods_local[] = { ! #ifdef WITH_TRUST ! "trust", ! #endif ! "peer", "reject", "md5", "password", "radius", #ifdef USE_PAM "pam", "pam ", #endif *************** usage(const char *progname) *** 2790,2803 **** } static void ! check_authmethod_unspecified(const char **authmethod) { if (*authmethod == NULL || strlen(*authmethod) == 0) { authwarning = _("\nWARNING: enabling \"trust\" authentication for local connections\n" "You can change this by editing pg_hba.conf or using the option -A, or\n" "--auth-local and --auth-host, the next time you run initdb.\n"); *authmethod = "trust"; } } --- 2802,2826 ---- } static void ! check_authmethod_unspecified(const char **authmethod, const char *conntype) { if (*authmethod == NULL || strlen(*authmethod) == 0) { + #ifdef WITH_TRUST authwarning = _("\nWARNING: enabling \"trust\" authentication for local connections\n" "You can change this by editing pg_hba.conf or using the option -A, or\n" "--auth-local and --auth-host, the next time you run initdb.\n"); *authmethod = "trust"; + #else + if (strcmp(conntype, "local") == 0) { + authwarning = _("\nWARNING: enabling \"peer\" authentication for local connections\n" + "You can change this by editing pg_hba.conf or using the option -A, or\n" + "--auth-local and --auth-host, the next time you run initdb.\n"); + *authmethod = "peer"; + } else { + *authmethod = "md5"; + } + #endif } } *************** main(int argc, char *argv[]) *** 3586,3593 **** exit(1); } ! check_authmethod_unspecified(&authmethodlocal); ! check_authmethod_unspecified(&authmethodhost); check_authmethod_valid(authmethodlocal, auth_methods_local, "local"); check_authmethod_valid(authmethodhost, auth_methods_host, "host"); --- 3609,3616 ---- exit(1); } ! check_authmethod_unspecified(&authmethodlocal, "local"); ! check_authmethod_unspecified(&authmethodhost, "host"); check_authmethod_valid(authmethodlocal, auth_methods_local, "local"); check_authmethod_valid(authmethodhost, auth_methods_host, "host"); diff --git a/src/include/pg_config.h.in b/src/include/pg_config.h.in new file mode 100644 index 5688f75..888d29b *** a/src/include/pg_config.h.in --- b/src/include/pg_config.h.in *************** *** 51,56 **** --- 51,62 ---- /* Define to build with GSSAPI support. (--with-gssapi) */ #undef ENABLE_GSS + /* Define to build with trust authentication turned on (default, --without-trust-auth to turn off) */ + #undef WITH_TRUST + + /* Define to build with ident authentication turned on (default, --without-ident-auth to turn off) */ + #undef WITH_IDENT + /* Define to 1 if you want National Language Support. (--enable-nls) */ #undef ENABLE_NLS