Re: Thoughts on pg_hba.conf rejection

Simon,

* Simon Riggs (simon(at)2ndQuadrant(dot)com) wrote:
> So instead of the typical "reject" instruction we also add a
> "rejectverbose" instruction that has a more verbose message. Docs would
> describe it as an additional instruction to assist with debugging a
> complex pg_hba.conf, with warning that if used it may assist the bad
> guys also.

Erm, so we'd add an option for this? That strikes me as pretty
excessive. Not to be a pain, but I feel like the 'connection not
authorized' argument plus a hint makes alot more sense.

> "pg_hba.conf rejects entry for host..."

"connection not authorized for host X user Y database Z"
"HINT: Make sure your pg_hba.conf has the entries needed and the user
has CONNECT privileges for the database"

Or something along those lines (I added the other CONNECT issue because
it's one I've run into in the past.. :).

I do also wonder if we should consider having the error that's reported
to the log differ from that which is sent to the user.. I realize
that's a much bigger animal and might not help the novice, but it could
help with debugging complex pg_hba's without exposing info to possible
bad guys.

Thanks,

Stephen