Re: Thoughts on pg_hba.conf rejection

Robert Haas <robertmhaas@gmail.com>

From: Robert Haas <robertmhaas@gmail.com>

To: Tom Lane <tgl@sss.pgh.pa.us>

Cc: Aidan Van Dyk <aidan@highrise.ca>, Bruce Momjian <bruce@momjian.us>, Joshua Tolley <eggyknap@gmail.com>, Simon Riggs <simon@2ndquadrant.com>, pgsql-hackers@postgresql.org

Date: 2010-04-15T00:22:30Z

Lists: pgsql-hackers

On Wed, Apr 14, 2010 at 8:19 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
> I'm thinking there isn't anything much we can do here without using a
> different message wording for a match to a REJECT entry.  So it's a
> straight-up tradeoff of possible security information leakage against
> whether a different wording is really helpful to the admin.  Both of
> those seem like fairly marginal concerns, really, so I'm having a hard
> time deciding which one ought to win.  But given that nobody complained
> before this, is it worth changing?

What's wrong with something like "connection not permitted" or
"connection not authorized"?

...Robert