Index: src/bin/initdb/initdb.c
===================================================================
RCS file: /projects/cvsroot/pgsql-server/src/bin/initdb/initdb.c,v
retrieving revision 1.43
diff -c -r1.43 initdb.c
*** src/bin/initdb/initdb.c	14 Jul 2004 17:55:10 -0000	1.43
--- src/bin/initdb/initdb.c	15 Jul 2004 20:55:53 -0000
***************
*** 88,93 ****
--- 88,95 ----
  char	   *username = "";
  bool		pwprompt = false;
  char       *pwfilename = NULL;
+ bool        identauth = false;
+ bool        trustauth = false;
  bool		debug = false;
  bool		noclean = false;
  bool		show_setting = false;
***************
*** 119,124 ****
--- 121,135 ----
  int			n_buffers = 50;
  
  /*
+  * Warning messages for authentication methods
+  */
+ char *authtrust_warning =											\
+ 	"# CAUTION: Configuring the system for local \"trust\" authentication allows\n"
+ 	"# any local user to connect as any PostgreSQL user, including the database\n"
+ 	"# superuser. If you do not trust all your local users, use another\n"
+ 	"# authenication method.\n";
+ 
+ /*
   * Centralized knowledge of switches to pass to backend
   *
   * Note: in the shell-script version, we also passed PGDATA as a -D switch,
***************
*** 1114,1120 ****
  							  "host    all         all         ::1",
  							  "#host    all         all         ::1");
  #endif
! 
  	snprintf(path, sizeof(path), "%s/pg_hba.conf", pg_data);
  
  	writefile(path, conflines);
--- 1125,1141 ----
  							  "host    all         all         ::1",
  							  "#host    all         all         ::1");
  #endif
! 	
! 	/* Replace default authentication methods */
! 	conflines = replace_token(conflines,
! 							 "@authmethod@",
! 							 (pwprompt || pwfilename)?"md5":
! 							 identauth?"ident":"trust");
! 	
! 	conflines = replace_token(conflines,
! 							  "@authcomment@",
! 							  trustauth?authtrust_warning:"");
! 		
  	snprintf(path, sizeof(path), "%s/pg_hba.conf", pg_data);
  
  	writefile(path, conflines);
***************
*** 1972,1979 ****
  			 "                            environment)\n"));
  	printf(_("  --no-locale               equivalent to --locale=C\n"));
  	printf(_("  -U, --username=NAME       database superuser name\n"));
! 	printf(_("  -W, --pwprompt            prompt for a password for the new superuser\n"));
! 	printf(_("  --pwfile=filename         read password for the new superuser from file\n"));
  	printf(_("  -?, --help                show this help, then exit\n"));
  	printf(_("  -V, --version             output version information, then exit\n"));
  	printf(_("\nLess commonly used options:\n"));
--- 1993,2004 ----
  			 "                            environment)\n"));
  	printf(_("  --no-locale               equivalent to --locale=C\n"));
  	printf(_("  -U, --username=NAME       database superuser name\n"));
! 	printf(_("  -W, --pwprompt            prompt for a password for the new superuser,\n"
! 			 "                            and configure for password authentication\n"));
! 	printf(_("  --pwfile=filename         read password for the new superuser from file,\n"
! 			 "                            and configure for password authentication\n"));
! 	printf(_("  --ident                   configure for ident authentication\n"));
! 	printf(_("  --trust                   configure for trust authentication\n"));
  	printf(_("  -?, --help                show this help, then exit\n"));
  	printf(_("  -V, --version             output version information, then exit\n"));
  	printf(_("\nLess commonly used options:\n"));
***************
*** 2006,2011 ****
--- 2031,2038 ----
  		{"no-locale", no_argument, NULL, 8},
  		{"pwprompt", no_argument, NULL, 'W'},
  		{"pwfile", required_argument, NULL, 9},
+ 		{"ident", no_argument, NULL, 10},
+ 		{"trust", no_argument, NULL, 11},
  		{"username", required_argument, NULL, 'U'},
  		{"help", no_argument, NULL, '?'},
  		{"version", no_argument, NULL, 'V'},
***************
*** 2098,2103 ****
--- 2125,2136 ----
  			case 9:
  				pwfilename = xstrdup(optarg);
  				break;
+ 			case 10:
+ 				identauth = true;
+ 				break;
+ 			case 11:
+ 				trustauth = true;
+ 				break;
  			case 's':
  				show_setting = true;
  				break;
***************
*** 2128,2133 ****
--- 2161,2181 ----
  		fprintf(stderr, _("%s: you cannot specify both password prompt and password file\n"), progname);
  		exit(1);
  	}
+ 	
+ 	if (!(pwprompt || pwfilename || identauth || trustauth))
+ 	{
+ 		fprintf(stderr, _("%s: no authentication method specified. You must specify password, ident or trust authentication\n"),progname);
+ 		exit(1);
+ 	}
+ 
+ 	if ( (pwprompt?1:0) +
+ 		 (pwfilename?1:0) + 
+ 		 (identauth?1:0) +
+ 		 (trustauth?1:0) > 1)
+ 	{
+ 		fprintf(stderr, _("%s: you cannot specify more than one authentication method\n"),progname);
+ 		exit(1);
+ 	}
  
  	if (strlen(pg_data) == 0)
  	{
Index: src/backend/libpq/pg_hba.conf.sample
===================================================================
RCS file: /projects/cvsroot/pgsql-server/src/backend/libpq/pg_hba.conf.sample,v
retrieving revision 1.48
diff -c -r1.48 pg_hba.conf.sample
*** src/backend/libpq/pg_hba.conf.sample	25 Dec 2003 03:44:05 -0000	1.48
--- src/backend/libpq/pg_hba.conf.sample	15 Jul 2004 20:45:00 -0000
***************
*** 48,67 ****
  # Put your actual configuration here
  # ----------------------------------
  #
- # CAUTION: The default configuration allows any local user to connect
- # using any PostgreSQL user name, including the superuser, over either
- # Unix-domain sockets or TCP/IP.  If you are on a multiple-user
- # machine, the default configuration is probably too liberal for you.
- # Change it to use something other than "trust" authentication.
- #
  # If you want to allow non-local connections, you need to add more
  # "host" records.  Also, remember TCP/IP connections are only enabled
  # if you enable "tcpip_socket" in postgresql.conf.
  
  # TYPE  DATABASE    USER        IP-ADDRESS        IP-MASK           METHOD
  
! local   all         all                                             trust
  # IPv4-style local connections:
! host    all         all         127.0.0.1         255.255.255.255   trust
  # IPv6-style local connections:
! host    all         all         ::1/128                             trust
--- 48,63 ----
  # Put your actual configuration here
  # ----------------------------------
  #
  # If you want to allow non-local connections, you need to add more
  # "host" records.  Also, remember TCP/IP connections are only enabled
  # if you enable "tcpip_socket" in postgresql.conf.
  
+ @authcomment@
+ 
  # TYPE  DATABASE    USER        IP-ADDRESS        IP-MASK           METHOD
  
! local   all         all                                             @authmethod@
  # IPv4-style local connections:
! host    all         all         127.0.0.1         255.255.255.255   @authmethod@
  # IPv6-style local connections:
! host    all         all         ::1/128                             @authmethod@
