Re: replication and pg_hba.conf

On 16.01.2011 22:55, Josh Berkus wrote:
>
>> In 9.0, we specifically require using "replication" as database name
>> to start a replication session. In 9.1 we will have the REPLICATION
>> attribute to a role - should we change it so that "all" in database
>> includes replication connections? It certainly goes in the "principle
>> of least surprise" path..
>
> +1. It'll eliminate an entire file to edit for replication setup, so
> does a lot to make initial replication setup easier.

No, we should by secure by default. You usually want to lock down
tightly where replication connections can come from. You know the IP
addresses of your standby servers, so it shouldn't be hard to

If "all" includes replication connections, that makes it harder to
configure pg_hba.conf correctly so that you allow normal connections
from anywhere, but only allow replication connections from a specific IP
address. You'd need two lines, first one to accept replication
connections from the standby, and a second one to reject them from
anywhere else.

But I wonder if we should add lines in the default pg_hba.conf to
"trust" replication connections from loopback, like we do for normal
connections?

--
Heikki Linnakangas
EnterpriseDB http://www.enterprisedb.com