Re: fyi: possible security bug linking from MS Access

On Mon, 2003-11-17 at 20:28, Fred Parkinson wrote:
> I am using ms access (XP, aka 2002) to link to a postgres database with
> odbc driver 7.02.00.05 and using the ms access facilities
> File>Get external data>link tables>ODBC databases().
>
> If I start my app the normal way I am asked to provide a postgres user
> and password.
>
> However, if i start Access with the shift key down, so my startup form
> doesn't open, delete my table links and relink, I am never asked for my
> postgres user and password yet am successfully linked to the postgres
> tables and my app behaves normally. I simply open the startup form and
> I am in without needing the postgres user and password.

It sounds as if the server is set to allow open access using "trust"
authentication. The relevant file on the server is $PGDATA/pg_hba.conf;
read the chapter on client authentication in the PostgreSQL manuals.

--
Oliver Elphick Oliver(dot)Elphick(at)lfix(dot)co(dot)uk
Isle of Wight, UK http://www.lfix.co.uk/oliver
GPG: 1024D/3E1D0C1C: CA12 09E0 E8D5 8870 5839 932A 614D 4C34 3E1D 0C1C
========================================
"For by grace are ye saved through faith; and that not
of yourselves. It is the gift of God; not of works,
lest any man should boast." Ephesians 2:8,9