diff options
Diffstat (limited to 'doc/src/sgml/high-availability.sgml')
| -rw-r--r-- | doc/src/sgml/high-availability.sgml | 21 |
1 files changed, 6 insertions, 15 deletions
diff --git a/doc/src/sgml/high-availability.sgml b/doc/src/sgml/high-availability.sgml index 86c2729cfd3..c5db6ef01f8 100644 --- a/doc/src/sgml/high-availability.sgml +++ b/doc/src/sgml/high-availability.sgml @@ -797,23 +797,14 @@ archive_cleanup_command = 'pg_archivecleanup /path/to/archive %r' It is very important that the access privileges for replication be set up so that only trusted users can read the WAL stream, because it is easy to extract privileged information from it. Standby servers must - authenticate to the primary as an account that has the - <literal>REPLICATION</> privilege. So a role with the - <literal>REPLICATION</> and <literal>LOGIN</> privileges needs to be - created on the primary. + authenticate to the primary as a superuser or an account that has the + <literal>REPLICATION</> privilege. It is recommended to create a + dedicated user account with <literal>REPLICATION</> and <literal>LOGIN</> + privileges for replication. While <literal>REPLICATION</> privilege gives + very high permissions, it does not allow the user to modify any data on + the primary system, which the <literal>SUPERUSER</> privilege does. </para> - <note> - <para> - It is recommended that a dedicated user account is used for replication. - While the <literal>REPLICATION</> privilege is granted to superuser - accounts by default, it is not recommended to use superuser accounts - for replication. While <literal>REPLICATION</> privilege gives very high - permissions, it does not allow the user to modify any data on the - primary system, which the <literal>SUPERUSER</> privilege does. - </para> - </note> - <para> Client authentication for replication is controlled by a <filename>pg_hba.conf</> record specifying <literal>replication</> in the |