index 60a06590fec3a8a91d23b28369f3e2e786697549..98752c2875cd8d3256110ef275dce928a194705b 100644 (file)
</para>
<para>
- The simplest way to prevent spoofing for <literal>local</>
+ On way to prevent spoofing of <literal>local</>
connections is to use a Unix domain socket directory (<xref
linkend="guc-unix-socket-directories">) that has write permission only
for a trusted local user. This prevents a malicious user from creating
<filename>/tmp</> cleanup script to prevent removal of the symbolic link.
</para>
+ <para>
+ Another option for <literal>local</> connections is for clients to use
+ <link linkend="libpq-connect-requirepeer"><literal>requirepeer</></>
+ to specify the required owner of the server process connected to
+ the socket.
+ </para>
+
<para>
To prevent spoofing on TCP connections, the best solution is to use
SSL certificates and make sure that clients check the server's certificate.