Joshua Tolley wrote: -- Start of PGP signed section. > On Wed, Apr 07, 2010 at 01:07:21PM -0400, Robert Haas wrote: > > On Wed, Apr 7, 2010 at 10:46 AM, Tom Lane <t...@sss.pgh.pa.us> wrote: > > > Simon Riggs <si...@2ndquadrant.com> writes: > > >> When there is a specific reject rule, why does the server say > > >> FATAL: ?no pg_hba.conf entry > > > > > > It's intentional. ?We try to expose the minimum amount of knowledge > > > about the contents of pg_hba.conf to potential attackers. > > > > The problem with the message is not that it's uninformative, but that > > it's counterfactual. > > > > ...Robert > > I agree (I noticed and was bothered by this today, as a matter of irrelevant > fact). I can support the idea of exposing as little as possible of > pg_hba.conf, but ISTM the "no pg_hba.conf entry" is exposing too much, by that > standard. Just say something like "connection disallowed" and leave it at that > -- either it's disallowed by lack of a rule, or by existence of a "reject" > rule, or by something else entirely. As long as the message isn't clearly > wrong in the "reject" case, as it is now.
Did we come to any conclusion on this? -- Bruce Momjian <br...@momjian.us> http://momjian.us EnterpriseDB http://enterprisedb.com -- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers
