I just installed postgresql on my mac (lion) using homebrew, and when I use the psql postgres (or any other database), it automatically logs me in.
Funny thing is, even if change the password once in psql using the \password command, it still just lets me in without prompting me for a password.
It also shows my user name (same user name as my mac os login) as the owner.
Is there a way to secure things a bit more?
Postgresql is most likely configured to trust anyone. This is configured int the file pg_hba.conf which is located in the data directory of postgresql. I do not know where homebrew places the data dir. However if you issue the following command in a terminal:
ps aux | grep postmaster
you will get a response like:
postgres 63 0,0 0,1 2472288 4888 ?? Ss 12:19pm 0:00.85 /Library/PostgreSQL/9.0/bin/postmaster -D/Library/PostgreSQL/9.0/data
The part after -D is the location of your data directory. You might have to resize your terminal to make it fit.
Open the pg_hba.conf with your favorite editor like:
sudo vi <datadir>/pg_hba.conf
The file contains (on all installations I have seen) a fair bit of comment describing the settings. The actual settings are a the bottom of the file. I suspect that one or more of those lines end in trust. Change these into md5 to get password verification.
show pg_hba.conf;. Documentation for the file is postgresql.org/docs/current/interactive/auth-pg-hba-conf.html
show data_directory;