Re: HINT: pg_hba.conf changed since last config reload

Hi,

On 2014-08-10 19:48:29 +0800, Craig Ringer wrote:
> I just had an idea I wanted to run by you all before turning it into a
> patch.
>
> People seem to get confused when they get auth errors because they
> changed pg_hba.conf but didn't reload.
>
> Should we emit a HINT alongside the main auth error in that case?
>
> Given the amount of confusion that I see around pg_hba.conf from new
> users, I figure anything that makes it less confusing might be a good
> thing if there aren't other consequences.

I think we could/would only emit that to the server log because of
security concerns. It very well might be interesting for an attacker to
know that an outdated hba.conf is still being used... Would that still
provide enough benefits?

Greetings,

Andres Freund

--
Andres Freund http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Training & Services