From: | Petr Jelinek <petr(dot)jelinek(at)2ndquadrant(dot)com> |
---|---|
To: | Simon Riggs <simon(at)2ndquadrant(dot)com>, Michael Paquier <michael(dot)paquier(at)gmail(dot)com> |
Cc: | PostgreSQL mailing lists <pgsql-hackers(at)postgresql(dot)org> |
Subject: | Re: Enabling replication connections by default in pg_hba.conf |
Date: | 2017-02-02 14:37:00 |
Message-ID: | f6abd754-37b2-5cc8-af35-25fbf9795ae4@2ndquadrant.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
On 02/02/17 14:32, Simon Riggs wrote:
> On 23 January 2017 at 04:29, Michael Paquier <michael(dot)paquier(at)gmail(dot)com> wrote:
>> Hi all,
>>
>> As now wal_level = replica has become the default for Postgres 10,
>> could we consider as well making replication connections enabled by
>> default in pg_hba.conf?
>
> Agreed
>
>> This requires just uncommenting a couple of
>> lines in pg_hba.conf.sample.
>
> I don't think that is the right way to do this. Changing the default
> doesn't reduce the complexity.
>
> I think we should remove the "replication" false database concept in
> pg_hba.conf altogether and allow any valid pg_hba rule to invoke a
> replication connection, if one is requested. Roles would still need
> the REPLICATION capability before this would be allowed. Having both
> of those things doesn't materially improve security control.
>
+1
> It would also be useful to be able prevent users with REPLICATION
> capability from connecting as normal users, if the are marked as
> NOLOGIN.
>
+1
--
Petr Jelinek http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Training & Services
From | Date | Subject | |
---|---|---|---|
Next Message | Tom Lane | 2017-02-02 14:49:20 | Re: Non-deterministic behavior with floating point in parallel mode |
Previous Message | REIX, Tony | 2017-02-02 14:10:45 | Re: Deadlock in XLogInsert at AIX |