codekingpro/portable-devtools

1# PostgreSQL Client Authentication Configuration File2# ===================================================3#4# Refer to the "Client Authentication" section in the PostgreSQL5# documentation for a complete description of this file.  A short6# synopsis follows.7#8# ----------------------9# Authentication Records10# ----------------------11#12# This file controls: which hosts are allowed to connect, how clients13# are authenticated, which PostgreSQL user names they can use, which14# databases they can access.  Records take one of these forms:15#16# local         DATABASE  USER  METHOD  [OPTIONS]17# host          DATABASE  USER  ADDRESS  METHOD  [OPTIONS]18# hostssl       DATABASE  USER  ADDRESS  METHOD  [OPTIONS]19# hostnossl     DATABASE  USER  ADDRESS  METHOD  [OPTIONS]20# hostgssenc    DATABASE  USER  ADDRESS  METHOD  [OPTIONS]21# hostnogssenc  DATABASE  USER  ADDRESS  METHOD  [OPTIONS]22#23# (The uppercase items must be replaced by actual values.)24#25# The first field is the connection type:26# - "local" is a Unix-domain socket27# - "host" is a TCP/IP socket (encrypted or not)28# - "hostssl" is a TCP/IP socket that is SSL-encrypted29# - "hostnossl" is a TCP/IP socket that is not SSL-encrypted30# - "hostgssenc" is a TCP/IP socket that is GSSAPI-encrypted31# - "hostnogssenc" is a TCP/IP socket that is not GSSAPI-encrypted32#33# DATABASE can be "all", "sameuser", "samerole", "replication", a34# database name, a regular expression (if it starts with a slash (/))35# or a comma-separated list thereof.  The "all" keyword does not match36# "replication".  Access to replication must be enabled in a separate37# record (see example below).38#39# USER can be "all", a user name, a group name prefixed with "+", a40# regular expression (if it starts with a slash (/)) or a comma-separated41# list thereof.  In both the DATABASE and USER fields you can also write42# a file name prefixed with "@" to include names from a separate file.43#44# ADDRESS specifies the set of hosts the record matches.  It can be a45# host name, or it is made up of an IP address and a CIDR mask that is46# an integer (between 0 and 32 (IPv4) or 128 (IPv6) inclusive) that47# specifies the number of significant bits in the mask.  A host name48# that starts with a dot (.) matches a suffix of the actual host name.49# Alternatively, you can write an IP address and netmask in separate50# columns to specify the set of hosts.  Instead of a CIDR-address, you51# can write "samehost" to match any of the server's own IP addresses,52# or "samenet" to match any address in any subnet that the server is53# directly connected to.54#55# METHOD can be "trust", "reject", "md5", "password", "scram-sha-256",56# "gss", "sspi", "ident", "peer", "pam", "ldap", "radius" or "cert".57# Note that "password" sends passwords in clear text; "md5" or58# "scram-sha-256" are preferred since they send encrypted passwords.59#60# OPTIONS are a set of options for the authentication in the format61# NAME=VALUE.  The available options depend on the different62# authentication methods -- refer to the "Client Authentication"63# section in the documentation for a list of which options are64# available for which authentication methods.65#66# Database and user names containing spaces, commas, quotes and other67# special characters must be quoted.  Quoting one of the keywords68# "all", "sameuser", "samerole" or "replication" makes the name lose69# its special character, and just match a database or username with70# that name.71#72# ---------------73# Include Records74# ---------------75#76# This file allows the inclusion of external files or directories holding77# more records, using the following keywords:78#79# include           FILE80# include_if_exists FILE81# include_dir       DIRECTORY82#83# FILE is the file name to include, and DIR is the directory name containing84# the file(s) to include.  Any file in a directory will be loaded if suffixed85# with ".conf".  The files of a directory are ordered by name.86# include_if_exists ignores missing files.  FILE and DIRECTORY can be87# specified as a relative or an absolute path, and can be double-quoted if88# they contain spaces.89#90# -------------91# Miscellaneous92# -------------93#94# This file is read on server startup and when the server receives a95# SIGHUP signal.  If you edit the file on a running system, you have to96# SIGHUP the server for the changes to take effect, run "pg_ctl reload",97# or execute "SELECT pg_reload_conf()".98#99# ----------------------------------100# Put your actual configuration here101# ----------------------------------102#103# If you want to allow non-local connections, you need to add more104# "host" records.  In that case you will also need to make PostgreSQL105# listen on a non-local interface via the listen_addresses106# configuration parameter, or via the -i or -h command line switches.107 108@authcomment@109 110# TYPE  DATABASE        USER            ADDRESS                 METHOD111 112@remove-line-for-nolocal@# "local" is for Unix domain socket connections only113@remove-line-for-nolocal@local   all             all                                     @authmethodlocal@114# IPv4 local connections:115host    all             all             127.0.0.1/32            @authmethodhost@116# IPv6 local connections:117host    all             all             ::1/128                 @authmethodhost@118# Allow replication connections from localhost, by a user with the119# replication privilege.120@remove-line-for-nolocal@local   replication     all                                     @authmethodlocal@121host    replication     all             127.0.0.1/32            @authmethodhost@122host    replication     all             ::1/128                 @authmethodhost@123