| 1 |
# PostgreSQL Client Authentication Configuration File |
| 2 |
# =================================================== |
| 3 |
# |
| 4 |
# Refer to the "Client Authentication" section in the PostgreSQL |
| 5 |
# documentation for a complete description of this file. A short |
| 6 |
# synopsis follows. |
| 7 |
# |
| 8 |
# This file controls: which hosts are allowed to connect, how clients |
| 9 |
# are authenticated, which PostgreSQL user names they can use, which |
| 10 |
# databases they can access. Records take one of these forms: |
| 11 |
# |
| 12 |
# local DATABASE USER METHOD [OPTIONS] |
| 13 |
# host DATABASE USER CIDR-ADDRESS METHOD [OPTIONS] |
| 14 |
# hostssl DATABASE USER CIDR-ADDRESS METHOD [OPTIONS] |
| 15 |
# hostnossl DATABASE USER CIDR-ADDRESS METHOD [OPTIONS] |
| 16 |
# |
| 17 |
# (The uppercase items must be replaced by actual values.) |
| 18 |
# |
| 19 |
# The first field is the connection type: "local" is a Unix-domain |
| 20 |
# socket, "host" is either a plain or SSL-encrypted TCP/IP socket, |
| 21 |
# "hostssl" is an SSL-encrypted TCP/IP socket, and "hostnossl" is a |
| 22 |
# plain TCP/IP socket. |
| 23 |
# |
| 24 |
# DATABASE can be "all", "sameuser", "samerole", "replication", a |
| 25 |
# database name, or a comma-separated list thereof. |
| 26 |
# |
| 27 |
# USER can be "all", a user name, a group name prefixed with "+", or a |
| 28 |
# comma-separated list thereof. In both the DATABASE and USER fields |
| 29 |
# you can also write a file name prefixed with "@" to include names |
| 30 |
# from a separate file. |
| 31 |
# |
| 32 |
# CIDR-ADDRESS specifies the set of hosts the record matches. It is |
| 33 |
# made up of an IP address and a CIDR mask that is an integer (between |
| 34 |
# 0 and 32 (IPv4) or 128 (IPv6) inclusive) that specifies the number |
| 35 |
# of significant bits in the mask. Alternatively, you can write an IP |
| 36 |
# address and netmask in separate columns to specify the set of hosts. |
| 37 |
# Instead of a CIDR-address, you can write "samehost" to match any of |
| 38 |
# the server's own IP addresses, or "samenet" to match any address in |
| 39 |
# any subnet that the server is directly connected to. |
| 40 |
# |
| 41 |
# METHOD can be "trust", "reject", "md5", "password", "gss", "sspi", |
| 42 |
# "krb5", "ident", "pam", "ldap", "radius" or "cert". Note that |
| 43 |
# "password" sends passwords in clear text; "md5" is preferred since |
| 44 |
# it sends encrypted passwords. |
| 45 |
# |
| 46 |
# OPTIONS are a set of options for the authentication in the format |
| 47 |
# NAME=VALUE. The available options depend on the different |
| 48 |
# authentication methods -- refer to the "Client Authentication" |
| 49 |
# section in the documentation for a list of which options are |
| 50 |
# available for which authentication methods. |
| 51 |
# |
| 52 |
# Database and user names containing spaces, commas, quotes and other |
| 53 |
# special characters must be quoted. Quoting one of the keywords |
| 54 |
# "all", "sameuser", "samerole" or "replication" makes the name lose |
| 55 |
# its special character, and just match a database or username with |
| 56 |
# that name. |
| 57 |
# |
| 58 |
# This file is read on server startup and when the postmaster receives |
| 59 |
# a SIGHUP signal. If you edit the file on a running system, you have |
| 60 |
# to SIGHUP the postmaster for the changes to take effect. You can |
| 61 |
# use "pg_ctl reload" to do that. |
| 62 |
|
| 63 |
# Put your actual configuration here |
| 64 |
# ---------------------------------- |
| 65 |
# |
| 66 |
# If you want to allow non-local connections, you need to add more |
| 67 |
# "host" records. In that case you will also need to make PostgreSQL |
| 68 |
# listen on a non-local interface via the listen_addresses |
| 69 |
# configuration parameter, or via the -i or -h command line switches. |
| 70 |
|
| 71 |
# CAUTION: Configuring the system for local "trust" authentication |
| 72 |
# allows any local user to connect as any PostgreSQL user, including |
| 73 |
# the database superuser. If you do not trust all your local users, |
| 74 |
# use another authentication method. |
| 75 |
|
| 76 |
|
| 77 |
# TYPE DATABASE USER CIDR-ADDRESS METHOD |
| 78 |
# This file is in mageia svn: |
| 79 |
# $Id$ |
| 80 |
|
| 81 |
# Nanar: |
| 82 |
# This bypass global config for specific user/base |
| 83 |
<% |
| 84 |
|
| 85 |
# FIXME ip v6 is hardcoded, facter do not seems to support |
| 86 |
# fetch it |
| 87 |
for i in db |
| 88 |
%> |
| 89 |
host <%= i %> <%= i %> 127.0.0.1/32 md5 |
| 90 |
host <%= i %> <%= i %> ::1/128 md5 |
| 91 |
hostssl <%= i %> <%= i %> <%= ipaddress %>/32 md5 |
| 92 |
hostssl <%= i %> <%= i %> 2a02:2178:2:7::2/128 md5 |
| 93 |
<% |
| 94 |
end |
| 95 |
%> |
| 96 |
|
| 97 |
<% |
| 98 |
lang = ['en'] |
| 99 |
for l in lang |
| 100 |
%> |
| 101 |
host phpbb_<%= l %> phpbb 127.0.0.1/32 md5 |
| 102 |
host phpbb_<%= l %> phpbb ::1/128 md5 |
| 103 |
hostssl phpbb_<%= l %> phpbb <%= ipaddress %>/32 md5 |
| 104 |
hostssl phpbb_<%= l %> phpbb 2a02:2178:2:7::2/128 md5 |
| 105 |
# temporary, for the forum on friteuse vm |
| 106 |
hostssl phpbb_<%= l %> phpbb 192.168.122.0/24 md5 |
| 107 |
<% |
| 108 |
end |
| 109 |
%> |
| 110 |
# When creating the database ( with bin/checkstup.pl ) bugzilla need to |
| 111 |
# access to template1 ( https://bugzilla.mozilla.org/show_bug.cgi?id=542507 ) |
| 112 |
host template1 bugs 127.0.0.1/32 md5 |
| 113 |
host template1 bugs ::1/128 md5 |
| 114 |
hostssl template1 bugs 212.85.158.146/32 md5 |
| 115 |
hostssl template1 bugs 2a02:2178:2:7::2/128 md5 |
| 116 |
|
| 117 |
# Allow youri-ckeck on rabbit to access the results db |
| 118 |
hostssl youri youri 88.190.12.224/32 md5 |
| 119 |
|
| 120 |
# "local" is for Unix domain socket connections only |
| 121 |
local all all ident map=local |
| 122 |
# IPv4 local connections: |
| 123 |
host all all 127.0.0.1/32 pam |
| 124 |
# IPv6 local connections: |
| 125 |
host all all ::1/128 pam |
| 126 |
|
| 127 |
hostssl all all 0.0.0.0/0 pam |
| 128 |
hostssl all all ::0/0 pam |
Parent Directory
| 
Revision Log