Re: fyi: possible security bug linking from MS Access

On Mon, 2003-11-17 at 20:28, Fred Parkinson wrote:
> I am using ms access (XP, aka 2002) to link to a postgres database with
> odbc driver 7.02.00.05 and using the ms access facilities
> File>Get external data>link tables>ODBC databases().
>
> If I start my app the normal way I am asked to provide a postgres user
> and password.
>
> However, if i start Access with the shift key down, so my startup form
> doesn't open, delete my table links and relink, I am never asked for my
> postgres user and password yet am successfully linked to the postgres
> tables and my app behaves normally.  I simply open the startup form and
> I am in without needing the postgres user and password.

It sounds as if the server is set to allow open access using "trust"
authentication.  The relevant file on the server is $PGDATA/pg_hba.conf;
read the chapter on client authentication in the PostgreSQL manuals.

--
Oliver Elphick                                Oliver.Elphick@lfix.co.uk
Isle of Wight, UK                             http://www.lfix.co.uk/oliver
GPG: 1024D/3E1D0C1C: CA12 09E0 E8D5 8870 5839  932A 614D 4C34 3E1D 0C1C
                 ========================================
     "For by grace are ye saved through faith; and that not
      of yourselves. It is the gift of God; not of works,
      lest any man should boast."    Ephesians 2:8,9