Skip to content

Commit 8a02339

Browse files
peterepetere
committed
initdb: Add options --auth-local and --auth-host
reviewed by Robert Haas and Pavel Stehule
1 parent 69f4f1c commit 8a02339

File tree

3 files changed

+134
-62
lines changed

3 files changed

+134
-62
lines changed

‎doc/src/sgml/ref/initdb.sgml

Lines changed: 27 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -118,10 +118,33 @@ PostgreSQL documentation
118118
<term><option>--auth=<replaceable class="parameter">authmethod</replaceable></option></term>
119119
<listitem>
120120
<para>
121-
This option specifies the authentication method for local users
122-
used in <filename>pg_hba.conf</>. Do not use <literal>trust</>
123-
unless you trust all local users on your system. <literal>Trust</>
124-
is the default for ease of installation.
121+
This option specifies the authentication method for local users used
122+
in <filename>pg_hba.conf</> (<literal>host</literal>
123+
and <literal>local</literal> lines). Do not use <literal>trust</>
124+
unless you trust all local users on your system. <literal>trust</> is
125+
the default for ease of installation.
126+
</para>
127+
</listitem>
128+
</varlistentry>
129+
130+
<varlistentry>
131+
<term><option>--auth-host=<replaceable class="parameter">authmethod</replaceable></option></term>
132+
<listitem>
133+
<para>
134+
This option specifies the authentication method for local users via
135+
TCP/IP connections used in <filename>pg_hba.conf</>
136+
(<literal>host</literal> lines).
137+
</para>
138+
</listitem>
139+
</varlistentry>
140+
141+
<varlistentry>
142+
<term><option>--auth-local=<replaceable class="parameter">authmethod</replaceable></option></term>
143+
<listitem>
144+
<para>
145+
This option specifies the authentication method for local users via
146+
Unix-domain socket connections used in <filename>pg_hba.conf</>
147+
(<literal>local</literal> lines).
125148
</para>
126149
</listitem>
127150
</varlistentry>

‎src/backend/libpq/pg_hba.conf.sample

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -79,11 +79,11 @@
7979
@remove-line-for-nolocal@# "local" is for Unix domain socket connections only
8080
@remove-line-for-nolocal@local all all @authmethodlocal@
8181
# IPv4 local connections:
82-
host all all 127.0.0.1/32 @authmethod@
82+
host all all 127.0.0.1/32 @authmethodhost@
8383
# IPv6 local connections:
84-
host all all ::1/128 @authmethod@
84+
host all all ::1/128 @authmethodhost@
8585
# Allow replication connections from localhost, by a user with the
8686
# replication privilege.
8787
@remove-line-for-nolocal@#local replication @default_username@ @authmethodlocal@
88-
#host replication @default_username@ 127.0.0.1/32 @authmethod@
89-
#host replication @default_username@ ::1/128 @authmethod@
88+
#host replication @default_username@ 127.0.0.1/32 @authmethodhost@
89+
#host replication @default_username@ ::1/128 @authmethodhost@

‎src/bin/initdb/initdb.c

Lines changed: 103 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,34 @@
6464
/* Ideally this would be in a .h file, but it hardly seems worth the trouble */
6565
extern const char *select_default_timezone(const char *share_path);
6666

67+
static const char *auth_methods_host[] = {"trust", "reject", "md5", "password", "ident", "radius",
68+
#ifdef ENABLE_GSS
69+
"gss",
70+
#endif
71+
#ifdef ENABLE_SSPI
72+
"sspi",
73+
#endif
74+
#ifdef KRB5
75+
"krb5",
76+
#endif
77+
#ifdef USE_PAM
78+
"pam", "pam ",
79+
#endif
80+
#ifdef USE_LDAP
81+
"ldap",
82+
#endif
83+
#ifdef USE_SSL
84+
"cert",
85+
#endif
86+
NULL};
87+
static const char *auth_methods_local[] = {"trust", "reject", "md5", "password", "peer", "radius",
88+
#ifdef USE_PAM
89+
"pam", "pam ",
90+
#endif
91+
#ifdef USE_LDAP
92+
"ldap",
93+
#endif
94+
NULL};
6795

6896
/*
6997
* these values are passed in by makefile defines
@@ -84,8 +112,8 @@ static const char *default_text_search_config = "";
84112
static char *username = "";
85113
static bool pwprompt = false;
86114
static char *pwfilename = NULL;
87-
static char *authmethod = "";
88-
static char *authmethodlocal = "";
115+
static const char *authmethodhost = "";
116+
static const char *authmethodlocal = "";
89117
static bool debug = false;
90118
static bool noclean = false;
91119
static bool show_setting = false;
@@ -1090,15 +1118,15 @@ setup_config(void)
10901118

10911119
/* Replace default authentication methods */
10921120
conflines = replace_token(conflines,
1093-
"@authmethod@",
1094-
authmethod);
1121+
"@authmethodhost@",
1122+
authmethodhost);
10951123
conflines = replace_token(conflines,
10961124
"@authmethodlocal@",
10971125
authmethodlocal);
10981126

10991127
conflines = replace_token(conflines,
11001128
"@authcomment@",
1101-
strcmp(authmethod, "trust") != 0 ? "" : AUTHTRUST_WARNING);
1129+
(strcmp(authmethodlocal, "trust") == 0 || strcmp(authmethodhost, "trust") == 0) ? AUTHTRUST_WARNING : "");
11021130

11031131
/* Replace username for replication */
11041132
conflines = replace_token(conflines,
@@ -2452,6 +2480,8 @@ usage(const char *progname)
24522480
printf(_(" %s [OPTION]... [DATADIR]\n"), progname);
24532481
printf(_("\nOptions:\n"));
24542482
printf(_(" -A, --auth=METHOD default authentication method for local connections\n"));
2483+
printf(_(" --auth-host=METHOD default authentication method for local TCP/IP connections\n"));
2484+
printf(_(" --auth-local=METHOD default authentication method for local-socket connections\n"));
24552485
printf(_(" [-D, --pgdata=]DATADIR location for this database cluster\n"));
24562486
printf(_(" -E, --encoding=ENCODING set default encoding for new databases\n"));
24572487
printf(_(" --locale=LOCALE set default locale for new databases\n"));
@@ -2479,6 +2509,50 @@ usage(const char *progname)
24792509
printf(_("\nReport bugs to <pgsql-bugs@postgresql.org>.\n"));
24802510
}
24812511

2512+
static void
2513+
check_authmethod_unspecified(const char **authmethod)
2514+
{
2515+
if (*authmethod == NULL || strlen(*authmethod) == 0)
2516+
{
2517+
authwarning = _("\nWARNING: enabling \"trust\" authentication for local connections\n"
2518+
"You can change this by editing pg_hba.conf or using the option -A, or\n"
2519+
"--auth-local and --auth-host, the next time you run initdb.\n");
2520+
*authmethod = "trust";
2521+
}
2522+
}
2523+
2524+
static void
2525+
check_authmethod_valid(const char *authmethod, const char **valid_methods, const char *conntype)
2526+
{
2527+
const char **p;
2528+
2529+
for (p = valid_methods; *p; p++)
2530+
{
2531+
if (strcmp(authmethod, *p) == 0)
2532+
return;
2533+
/* with space = param */
2534+
if (strchr(authmethod, ' '))
2535+
if (strncmp(authmethod, *p, (authmethod - strchr(authmethod, ' '))) == 0)
2536+
return;
2537+
}
2538+
2539+
fprintf(stderr, _("%s: invalid authentication method \"%s\" for \"%s\" connections\n"),
2540+
progname, authmethod, conntype);
2541+
exit(1);
2542+
}
2543+
2544+
static void
2545+
check_need_password(const char *authmethod)
2546+
{
2547+
if ((strcmp(authmethod, "md5") == 0 ||
2548+
strcmp(authmethod, "password") == 0) &&
2549+
!(pwprompt || pwfilename))
2550+
{
2551+
fprintf(stderr, _("%s: must specify a password for the superuser to enable %s authentication\n"), progname, authmethod);
2552+
exit(1);
2553+
}
2554+
}
2555+
24822556
int
24832557
main(int argc, char *argv[])
24842558
{
@@ -2499,6 +2573,8 @@ main(int argc, char *argv[])
24992573
{"no-locale", no_argument, NULL, 8},
25002574
{"text-search-config", required_argument, NULL, 'T'},
25012575
{"auth", required_argument, NULL, 'A'},
2576+
{"auth-local", required_argument, NULL, 10},
2577+
{"auth-host", required_argument, NULL, 11},
25022578
{"pwprompt", no_argument, NULL, 'W'},
25032579
{"pwfile", required_argument, NULL, 9},
25042580
{"username", required_argument, NULL, 'U'},
@@ -2567,7 +2643,22 @@ main(int argc, char *argv[])
25672643
switch (c)
25682644
{
25692645
case 'A':
2570-
authmethod = xstrdup(optarg);
2646+
authmethodlocal = authmethodhost = xstrdup(optarg);
2647+
/*
2648+
* When ident is specified, use peer for local connections.
2649+
* Mirrored, when peer is specified, use ident for TCP/IP
2650+
* connections.
2651+
*/
2652+
if (strcmp(authmethodhost, "ident") == 0)
2653+
authmethodlocal = "peer";
2654+
else if (strcmp(authmethodlocal, "peer") == 0)
2655+
authmethodhost = "ident";
2656+
break;
2657+
case 10:
2658+
authmethodlocal = xstrdup(optarg);
2659+
break;
2660+
case 11:
2661+
authmethodhost = xstrdup(optarg);
25712662
break;
25722663
case 'D':
25732664
pg_data = xstrdup(optarg);
@@ -2659,56 +2750,14 @@ main(int argc, char *argv[])
26592750
exit(1);
26602751
}
26612752

2662-
if (authmethod == NULL || !strlen(authmethod))
2663-
{
2664-
authwarning = _("\nWARNING: enabling \"trust\" authentication for local connections\n"
2665-
"You can change this by editing pg_hba.conf or using the -A option the\n"
2666-
"next time you run initdb.\n");
2667-
authmethod = "trust";
2668-
}
2753+
check_authmethod_unspecified(&authmethodlocal);
2754+
check_authmethod_unspecified(&authmethodhost);
26692755

2670-
if (strcmp(authmethod, "md5") != 0 &&
2671-
strcmp(authmethod, "peer") != 0 &&
2672-
strcmp(authmethod, "ident") != 0 &&
2673-
strcmp(authmethod, "trust") != 0 &&
2674-
#ifdef USE_PAM
2675-
strcmp(authmethod, "pam") != 0 &&
2676-
strncmp(authmethod, "pam ", 4) != 0 && /* pam with space = param */
2677-
#endif
2678-
strcmp(authmethod, "password") != 0
2679-
)
2756+
check_authmethod_valid(authmethodlocal, auth_methods_local, "local");
2757+
check_authmethod_valid(authmethodhost, auth_methods_host, "host");
26802758

2681-
/*
2682-
* Kerberos methods not listed because they are not supported over
2683-
* local connections and are rejected in hba.c
2684-
*/
2685-
{
2686-
fprintf(stderr, _("%s: unrecognized authentication method \"%s\"\n"),
2687-
progname, authmethod);
2688-
exit(1);
2689-
}
2690-
2691-
if ((strcmp(authmethod, "md5") == 0 ||
2692-
strcmp(authmethod, "password") == 0) &&
2693-
!(pwprompt || pwfilename))
2694-
{
2695-
fprintf(stderr, _("%s: must specify a password for the superuser to enable %s authentication\n"), progname, authmethod);
2696-
exit(1);
2697-
}
2698-
2699-
/*
2700-
* When ident is specified, use peer for local connections. Mirrored, when
2701-
* peer is specified, use ident for TCP connections.
2702-
*/
2703-
if (strcmp(authmethod, "ident") == 0)
2704-
authmethodlocal = "peer";
2705-
else if (strcmp(authmethod, "peer") == 0)
2706-
{
2707-
authmethodlocal = "peer";
2708-
authmethod = "ident";
2709-
}
2710-
else
2711-
authmethodlocal = authmethod;
2759+
check_need_password(authmethodlocal);
2760+
check_need_password(authmethodhost);
27122761

27132762
if (strlen(pg_data) == 0)
27142763
{

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy