Madison Kelly <linux@xxxxxxxxxxx> writes: > May I ask then? What *is* considered "best practices" for securing a > database in PostgreSQL? Assuming I leave the 'pg_hba.conf' file at it's > default values, is there any real point to having a password on a > postgresql user account? Well, if there were a single "best practice" then we'd not need to offer so many options ;-). It depends a lot on your needs and environment. On a single-user machine where you're not allowing any remote connections, you might as well use "trust" --- I tend to run all my development installations that way. Ident can be pretty convenient too for local users (I wouldn't trust it for remote connections though). Otherwise you probably need passwords. In any case, this just applies to whether you let someone connect or not. What they can do after they've connected is a different discussion. For that you use SQL privileges (GRANT/REVOKE). regards, tom lane
