English
- ." This is -*-nroff-*-
- ." $Header: /usr/local/cvsroot/pgsql/src/man/Attic/pg_hba.conf.5,v 1.7 1998/10/14 02:54:37 momjian Exp $
- .TH pg_hba.conf 5 1/26/98 PostgreSQL PostgreSQL
- .SH NAME
- $PGDATA/pg_hba.conf
- .SH DESCRIPTION
- "Host-based access control" is the name for the basic controls PostgreSQL
- exercises on what clients are allowed to access a database and how
- the users on those clients must authenticate themselves.
- .PP
- Each database system contains a file named "pg_hba.conf", in its $PGDATA
- directory, that controls who can connect to each database.
- .PP
- Every client that wants to access to a database
- .IR must
- be covered by one of
- the entries in pg_hba.conf. Otherwise all attempted connections from that
- client will be rejected with a "User authentication failed" error message.
- .PP
- The general format of the pg_hba.conf file is of a set of records, one per
- line. Blank lines and lines beginning with '#' are ignored. A record is
- made up of a number of fields which are separated by spaces and/or tabs.
- .PP
- Connections from clients can be made using UNIX domain sockets or Internet
- domain sockets (ie. TCP/IP). Connections made using UNIX domain sockets
- are controlled using records of the following format.
- .PP
- local <database> <authentication method>
- .PP
- <database> specifies the database that this record applies to. The value
- .IR all
- specifies that it applies to all databases. <authentication method>
- specifies the method a user must use to authenticate themselves when
- connecting to that database using UNIX domain sockets. The different methods
- are described below.
- .PP
- Connections made using Internet domain sockets are controlled using records
- of the following format.
- .PP
- host <database> <TCP/IP address> <TCP/IP mask> <authentication method>
- .PP
- The <TCP/IP mask> is logically anded to both the specified <TCP/IP address>
- and the TCP/IP address
- of the connecting client. If the two values that result are equal then the
- record is used for this connection. If a connection matches more than one
- record then the earliest one in the file is used. Both the <TCP/IP address>
- and the <TCP/IP mask> are specified in dotted decimal notation.
- .PP
- If a connection fails to match any record then the
- .IR reject
- authentication method is applied (see below).
- .SH "AUTHENTICATION METHODS"
- The following authentication methods are supported for both UNIX and TCP/IP
- domain sockets.
- .PP
- .IR trust
- - the connection is allowed unconditionally.
- .PP
- .IR reject
- - the connection is rejected unconditionally.
- .PP
- .IR crypt
- - the client is asked for a password for the user. This is sent encrypted
- (using crypt(3)) and compared against the password held in the pg_shadow table.
- If the passwords match, the connection is allowed.
- .PP
- .IR password
- - the client is asked for a password for the user. This is sent in clear
- and compared against the password held in the pg_shadow table.
- If the passwords match, the connection is allowed. An optional password file
- may be specified after the
- .IR password
- keyword which is used to match the supplied password rather than the pg_shadow
- table. See pg_passwd(1).
- .PP
- The following authentication methods are supported for TCP/IP
- domain sockets only.
- .PP
- .IR krb4
- - Kerberos V4 is used to authenticate the user.
- .PP
- .IR krb5
- - Kerberos V5 is used to authenticate the user.
- .PP
- .IR ident
- - the ident server on the client is used to authenticate the user (RFC 1413).
- An optional map name may be specified after the
- .IR ident
- keyword which allows ident user names to be mapped onto PostgreSQL user names.
- Maps are held in the file $PGDATA/pg_ident.conf.
- .SH EXAMPLES
- # Trust any connection via UNIX domain sockets.
- local trust
- # Trust any connection via TCP/IP from this machine.
- host all 127.0.0.1 255.255.255.255 trust
- # We don't like this machine.
- host all 192.168.0.10 255.255.255.0 reject
- # This machine can't encrypt so we ask for passwords in clear.
- host all 192.168.0.3 255.255.255.0 password
- # The rest of this group of machines should provide encrypted passwords.
- host all 192.168.0.0 255.255.255.0 crypt
