password security

Howdy:

Running PostgreSQL 7.2.1 on RedHat Linux 7.2.

We have a user community that connects to the
database via ODBC drivers. They use a few
applications, but for the most part, it's MS Access.

I've changed the passwords for users so that
they will have to set their passwords in
the ODBC configuration. On PostgreSQL I
just did:

"alter user <username> with encrypted 'passwd'"

and it looked okay (no errors to speak of returned).

BUT, when the users log on without changing thier
configuration, they can still access the tables.

Is there something else I should change? Something
in the hba.conf file?

Any other documentation specifically to securing
the database (permissions, groups, etc)?

Thanks!

-X