Re: Bugtraq: Having Fun With PostgreSQL

On Jun 18, 2007, at 12:58 AM, Tom Lane wrote:
> "Joshua D. Drake" <jd(at)commandprompt(dot)com> writes:
>> Christopher Browne wrote:
>>> That won't help; that would introduce the "embarrassment" of
>>> having a
>>> known default password.
>
>> No it wouldn't unless the packagers set it up to do that. My point is
>> that when a packager (or source) runs initdb, it would prompt for the
>> postgres user password.
>
> Practically every existing packaging of PG tries to run initdb as a
> hidden, behind-the-scenes, definitely not-interactive procedure.

I know there's issues with using ident sameuser via TCP, but what
about for filesystem socket connections?

As for the interactive/non-interactive, we could just leave that as
an option to initdb, and make the default to ask for a password.
Packagers would just need to feed the right option to initdb.
--
Jim Nasby jim(at)nasby(dot)net
EnterpriseDB http://enterprisedb.com 512.569.9461 (cell)