[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Best practice for allowing access to a postgres db



Hi again!

Long time no see about this topic, time to revive it a bit :-)

sean finney [2005-06-17 10:07 -0400]:
> On Fri, Jun 17, 2005 at 09:24:30AM +0200, Martin Pitt wrote:
> > Me neither, but putting the proposed scripts into dbconfig-common
> > would be equally sane for me.
> 
> what would make the most sense to me would be to spend some time
> together developing the interface scripts, host them in postgresql-common,

Right, I'm going to develop them soon now. However, before doing so
I'd like to agree to the interface so that it actually makes sense for
you (I'm not overly familiar with web apps, I just use them on the
same server than the DB, and I only use the default pg_hba.conf on
them, which works for my purposes).

So far my initial spec would be like this:

---- snip ----
  pg_add_hba [options] yourwebappdb yourwebappuser
  pg_remove_hba [options] yourwebappdb yourwebappuser

  Options:

  --cluster: self-explanatory, defaults to default cluster
  --ip: IP and netmask for host socket; if not given, defaults to Unix
    socket (local)
  --method: defaults to "md5" for TCP connections, and "ident" for
    Unix socket connections
  --force-ssl: If given, create a "hostssl" entry, otherwise a "host"
    entry

  For pg_remove_hba, only --cluster is allowed; it will remove all hba
  entries that refer to the given db/user pair.
---- snip ----

--cluster and --method have a reasonable default, so dbconfig-common
should only need to real with --ip and --force-ssl, which seems to be
straightforward to me.

I'd appreciate any comments about this. Please also just tell me how
an interface should look like from *your* perspective, since you
should not adapt your problems to my solution. :)

Thanks,

Martin

-- 
Martin Pitt        http://www.piware.de
Ubuntu Developer   http://www.ubuntu.com
Debian Developer   http://www.debian.org

Attachment: signature.asc
Description: Digital signature


Reply to: