korry wrote:
>>Since what he is worried about is the ability of admins to get at the
>>data by connecting to the postgres server (after changing pg_hba.conf),
>>this will not make the slightest difference - the data would be
>>decrypted before it ever got to the intruder.
>>
>>
>
>I was suggesting that pg_hba.conf could be stored in the same encrypting
>filesystem.
>
>
>
>
Then how can it be changed? What if you need to allow access from, say,
another user or another network? Oh, the admins have to change it ...
In the end you have to trust your admins or fire them and hire some you
do trust.
cheers
andrew