Michael Fork <mfork@toledolink.com> writes:
> However, these lines are in pg_hba.conf, which in my opinion needs should
> have a disclaimer in big letters as to exactly the security hole it
> creates.
>
> #host all 192.168.54.1 255.255.255.255 reject
> #host all 0.0.0.0 0.0.0.0 trust
> #
> # The above would allow anyone anywhere except from 192.168.54.1 to
> # connect to any database under any username.
Well, it does *say* that, but maybe the letters aren't blinking red ;-)
There's no real good reason to use such a damn-fool configuration as
an example anyway, so I've modified the example to show Kerberos
authentication allowed from anywhere. Better?
regards, tom lane