Re: Security note: MS SQL is current worm vector

> On Sunday 25 November 2001 18:13, Tom Lane wrote:
> > Lincoln Yeoh <lyeoh(at)pop(dot)jaring(dot)my> writes:
> > > Yeah, by default Postgresql ships practically without any access
> > > controls.
> >
> (...)
> > I do wonder whether we shouldn't list "think about your access controls"
> > as an explicit step in the installation instructions or server startup
> > instructions. The default configuration is definitely uncool on
> > multiuser machines, but a novice might not find that out till too late.
>
> It might be worth explicitly mentioning the following:
>
> 1) use initdb with the -W option, so that a superuser password
> is set during db initialisation and before the server is started;

I have added documentation for the -W flag. You can see it at:

http://216.55.132.35/main/writings/pgsql/sgml/creating-cluster.html

> 2) before starting the server change the appropriate settings
> in pg_hba.conf from 'trusted' to 'password' (or whatever other
> authentication system is to be used).

Also mentioned.

--
Bruce Momjian | http://candle.pha.pa.us
pgman(at)candle(dot)pha(dot)pa(dot)us | (610) 853-3000
+ If your life is a hard drive, | 830 Blythe Avenue
+ Christ can be your backup. | Drexel Hill, Pennsylvania 19026