Simon, * Simon Riggs (si...@2ndquadrant.com) wrote: > So instead of the typical "reject" instruction we also add a > "rejectverbose" instruction that has a more verbose message. Docs would > describe it as an additional instruction to assist with debugging a > complex pg_hba.conf, with warning that if used it may assist the bad > guys also.
Erm, so we'd add an option for this? That strikes me as pretty excessive. Not to be a pain, but I feel like the 'connection not authorized' argument plus a hint makes alot more sense. > "pg_hba.conf rejects entry for host..." "connection not authorized for host X user Y database Z" "HINT: Make sure your pg_hba.conf has the entries needed and the user has CONNECT privileges for the database" Or something along those lines (I added the other CONNECT issue because it's one I've run into in the past.. :). I do also wonder if we should consider having the error that's reported to the log differ from that which is sent to the user.. I realize that's a much bigger animal and might not help the novice, but it could help with debugging complex pg_hba's without exposing info to possible bad guys. Thanks, Stephen
signature.asc
Description: Digital signature