From 46651ce6fe013220ed397add242004d764fc0153 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sat, 4 May 2024 14:15:05 +0200 Subject: Adding upstream version 14.5. Signed-off-by: Daniel Baumann --- doc/src/sgml/html/auth-trust.html | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 doc/src/sgml/html/auth-trust.html (limited to 'doc/src/sgml/html/auth-trust.html') diff --git a/doc/src/sgml/html/auth-trust.html b/doc/src/sgml/html/auth-trust.html new file mode 100644 index 0000000..a8c1af8 --- /dev/null +++ b/doc/src/sgml/html/auth-trust.html @@ -0,0 +1,37 @@ + +21.4. Trust Authentication
21.4. Trust Authentication
Prev UpChapter 21. Client AuthenticationHome Next

21.4. Trust Authentication

+ When trust authentication is specified, + PostgreSQL assumes that anyone who can + connect to the server is authorized to access the database with + whatever database user name they specify (even superuser names). + Of course, restrictions made in the database and + user columns still apply. + This method should only be used when there is adequate + operating-system-level protection on connections to the server. +

+ trust authentication is appropriate and very + convenient for local connections on a single-user workstation. It + is usually not appropriate by itself on a multiuser + machine. However, you might be able to use trust even + on a multiuser machine, if you restrict access to the server's + Unix-domain socket file using file-system permissions. To do this, set the + unix_socket_permissions (and possibly + unix_socket_group) configuration parameters as + described in Section 20.3. Or you + could set the unix_socket_directories + configuration parameter to place the socket file in a suitably + restricted directory. +

+ Setting file-system permissions only helps for Unix-socket connections. + Local TCP/IP connections are not restricted by file-system permissions. + Therefore, if you want to use file-system permissions for local security, + remove the host ... 127.0.0.1 ... line from + pg_hba.conf, or change it to a + non-trust authentication method. +

+ trust authentication is only suitable for TCP/IP connections + if you trust every user on every machine that is allowed to connect + to the server by the pg_hba.conf lines that specify + trust. It is seldom reasonable to use trust + for any TCP/IP connections other than those from localhost (127.0.0.1). +

Prev Up Next
21.3. Authentication Methods Home 21.5. Password Authentication
\ No newline at end of file -- cgit v1.2.3