{"Entry":{"collection":"auth","key":"trust","name":"trust","aliases":[],"metadata":{"aliases":[],"category":"Authentication and access control","content_hash":"c1a8057247e10cb1b4f40fa724331983500786da2290ac5acecea25ffbc39678","derived_content_hash":"a9790fb5addae638de5088df3ff1914c00e819149d73d1ae95e46c8fb814564c","imported_at":"2026-09-30T00:40:33.365828+08:00","name":"trust","name_zh":"","slug":"trust","summary":"Allow the connection unconditionally. This method allows anyone that can connect to the PostgreSQL database server to login as any PostgreSQL user they wish, without the need for a password or any other authentication. See Section 20.4 for details."}},"Definition":{"Collection":"auth","Key":"trust","SourceDatabase":"center","Version":"18","SourceTable":"authentication_method","SourceKey":"trust","SourceRevision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","Facts":{"aliases":[],"attributes":{"configuration":"pg_hba.conf","inventory":"User-visible source authentication method","method":"trust"},"comparison_data":{"documented_option_names":[],"method":"trust"},"comparison_hash":"210f7621166817effd2ba02b45ddaf7562e7926b1a9ef4c7e4145fb9c662d19e","description":["Allow the connection unconditionally. This method allows anyone that can connect to the PostgreSQL database server to login as any PostgreSQL user they wish, without the need for a password or any other authentication. See Section 20.4 for details."],"description_zh":"认证方法 trust。","description_zh_html":"\u003cp\u003e认证方法 trust。\u003c/p\u003e\u003cdl\u003e\u003cdt\u003e索引访问方法\u003c/dt\u003e\u003cdd\u003e\u003ccode\u003etrust\u003c/code\u003e\u003c/dd\u003e\u003cdt\u003e配置\u003c/dt\u003e\u003cdd\u003e\u003ccode\u003epg_hba.conf\u003c/code\u003e\u003c/dd\u003e\u003c/dl\u003e\u003ch3\u003e同版本中文手册节选\u003c/h3\u003e\u003cp\u003e\n    当 \u003ccode class=\"literal\"\u003etrust\u003c/code\u003e 认证被指定时，\u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e 假设任何可以连接到服务器的人都被授权使用他们指定的任何数据库用户名（即使是超级用户）访问数据库。当然，在 \u003ccode class=\"literal\"\u003edatabase\u003c/code\u003e 和 \u003ccode class=\"literal\"\u003euser\u003c/code\u003e 列中设置的限制仍然适用。只有当在操作系统层对进入服务器的连接有足够保护时，才应该使用这种方法。\n   \u003c/p\u003e\u003cp\u003e\n\u003ccode class=\"literal\"\u003etrust\u003c/code\u003e 认证对于单用户工作站的本地连接是非常合适和方便的。通常它本身\u003cspan class=\"emphasis\"\u003e\u003cem\u003e不\u003c/em\u003e\u003c/span\u003e适用于一台多用户机器。不过，只要你利用文件系统权限限制了对服务器的 Unix 域套接字文件的访问，即使在多用户机器上，你也可能可以使用 \u003ccode class=\"literal\"\u003etrust\u003c/code\u003e。要做这些限制，你可以设置\u003ca class=\"xref\" href=\"/zh/docs/18/runtime-config-connection.html\"\u003e第 19.3 节\u003c/a\u003e中描述的 \u003ccode class=\"varname\"\u003eunix_socket_permissions\u003c/code\u003e 配置参数（可能还有 \u003ccode class=\"varname\"\u003eunix_socket_group\u003c/code\u003e）。或者你可以设置 \u003ccode class=\"varname\"\u003eunix_socket_directories\u003c/code\u003e 配置参数来把 Unix 域套接字文件放在一个经过恰当限制的目录中。\n   \u003c/p\u003e\u003cp\u003e\n    设置文件系统权限只能有助于 Unix 套接字连接。本地 TCP/IP 连接不会被文件系统权限限制。因此，如果你想利用文件系统权限来控制本地安全，那么从 \u003ccode class=\"filename\"\u003epg_hba.conf\u003c/code\u003e 中移除 \u003ccode class=\"literal\"\u003ehost ... 127.0.0.1 ...\u003c/code\u003e行，或者把它改为一个非 \u003ccode class=\"literal\"\u003etrust\u003c/code\u003e 认证方法。\n   \u003c/p\u003e\u003cp\u003e只有当你信任由 \u003ccode class=\"filename\"\u003epg_hba.conf\u003c/code\u003e 中指定 \u003ccode class=\"literal\"\u003etrust\u003c/code\u003e 的行所允许连接的每台机器上的每个用户时，\u003ccode class=\"literal\"\u003etrust\u003c/code\u003e 认证才适合用于 TCP/IP 连接。对来自 \u003cspan class=\"systemitem\"\u003elocalhost\u003c/span\u003e（127.0.0.1）以外的任何 TCP/IP 连接使用 \u003ccode class=\"literal\"\u003etrust\u003c/code\u003e，通常都不合理。\u003c/p\u003e\u003cp\u003e\u003ca href=\"/zh/docs/18/auth-trust.html\"\u003e查看完整中文手册与上下文\u003c/a\u003e。\u003c/p\u003e","facts":[{"label":"Method","value":"trust"},{"label":"Configuration","value":"pg_hba.conf"},{"label":"Inventory","value":"User-visible source authentication method"}],"facts_zh":[{"label":"方法","value":"trust"},{"label":"配置","value":"pg_hba.conf"},{"label":"清单","value":"用户可见的源码认证方法"}],"manual_html":"\u003cdiv class=\"sect1\" id=\"AUTH-TRUST\"\u003e\n\u003cdiv class=\"titlepage\"\u003e\n\u003cdiv\u003e\n\u003cdiv\u003e\n\u003ch2 class=\"title\"\u003e20.4. Trust Authentication \u003c/h2\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003cp\u003eWhen \u003ccode class=\"literal\"\u003etrust\u003c/code\u003e authentication is specified, \u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e assumes that anyone who can connect to the server is authorized to access the database with whatever database user name they specify (even superuser names). Of course, restrictions made in the \u003ccode class=\"literal\"\u003edatabase\u003c/code\u003e and \u003ccode class=\"literal\"\u003euser\u003c/code\u003e columns still apply. This method should only be used when there is adequate operating-system-level protection on connections to the server.\u003c/p\u003e\n\u003cp\u003e\u003ccode class=\"literal\"\u003etrust\u003c/code\u003e authentication is appropriate and very convenient for local connections on a single-user workstation. It is usually \u003cspan class=\"emphasis\"\u003e\u003cem\u003enot\u003c/em\u003e\u003c/span\u003e appropriate by itself on a multiuser machine. However, you might be able to use \u003ccode class=\"literal\"\u003etrust\u003c/code\u003e even on a multiuser machine, if you restrict access to the server's Unix-domain socket file using file-system permissions. To do this, set the \u003ccode class=\"varname\"\u003eunix_socket_permissions\u003c/code\u003e (and possibly \u003ccode class=\"varname\"\u003eunix_socket_group\u003c/code\u003e) configuration parameters as described in \u003ca class=\"xref\" href=\"/docs/18/runtime-config-connection.html\" title=\"19.3. Connections and Authentication\"\u003eSection 19.3\u003c/a\u003e. Or you could set the \u003ccode class=\"varname\"\u003eunix_socket_directories\u003c/code\u003e configuration parameter to place the socket file in a suitably restricted directory.\u003c/p\u003e\n\u003cp\u003eSetting file-system permissions only helps for Unix-socket connections. Local TCP/IP connections are not restricted by file-system permissions. Therefore, if you want to use file-system permissions for local security, remove the \u003ccode class=\"literal\"\u003ehost ... 127.0.0.1 ...\u003c/code\u003e line from \u003ccode class=\"filename\"\u003epg_hba.conf\u003c/code\u003e, or change it to a non-\u003ccode class=\"literal\"\u003etrust\u003c/code\u003e authentication method.\u003c/p\u003e\n\u003cp\u003e\u003ccode class=\"literal\"\u003etrust\u003c/code\u003e authentication is only suitable for TCP/IP connections if you trust every user on every machine that is allowed to connect to the server by the \u003ccode class=\"filename\"\u003epg_hba.conf\u003c/code\u003e lines that specify \u003ccode class=\"literal\"\u003etrust\u003c/code\u003e. It is seldom reasonable to use \u003ccode class=\"literal\"\u003etrust\u003c/code\u003e for any TCP/IP connections other than those from \u003cspan class=\"systemitem\"\u003elocalhost\u003c/span\u003e (127.0.0.1).\u003c/p\u003e\n\u003c/div\u003e","manual_path":"/docs/18/auth-trust.html","related":[],"release":{"catalog_fingerprint":"65c93d6048ef30e61023a84f9680fa6a92b1c383b7eb226741170077eb078502","channel":"stable","label":"18.6","major":"18","ref":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2","revision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","source_sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f"},"sections":[],"sections_zh":[],"signature":"","sources":[{"label":"Matching PostgreSQL source archive","sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","url":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2"},{"label":"PostgreSQL 18 English manual","path":"auth-trust.html","sha256":"e4c50d6f88b13feb2004634788c61e0f797ff2d5b1ab6bb86de30229cef38a87","url":"/docs/18/auth-trust.html"},{"label":"PostgreSQL 18 English manual","path":"auth-pg-hba-conf.html","sha256":"6340d4abea2e0a3482afc31bcd1599a0fa10dc28a6f1e05d79ba831e2dd0b4c9","url":"/docs/18/auth-pg-hba-conf.html"}],"tables":[],"tables_zh":[],"zh_from":{"authored_translation":"source-derived-structured-summary","body_sha256":"48583b9bd441fff2c2bd04c108f477d0cb30a3204c69eee2705bb0e578599e38","kind":"same-version-chinese-manual-with-source-derived-structured-summary","manual":{"anchor":"","build_id":107,"extraction":"concept-introduction","fragment_sha256":"b56bd73fa27fbd86fbfdb6f2562448eb61fdeef5f1ae4e71cf4f53d507d63188","locale":"zh-Hans","page_key":"auth-trust.html","source_hash":"03b866999d51e7d3bc4c8aa0137716febf703b5c8aa09956b5b6202c4edfbe11","source_revision":"unknown:rendered-translation-baseline","translated_from_revision":null,"translation_revision":"git:b1b500221dbe5437cfca004d6b04d3f6e422765d;html-sha256:08e987a66af27b98444a8057c256314eafa13611a3fb9e888214fc436824244b","url":"/zh/docs/18/auth-trust.html","version":"18"},"runtime_rerun":false,"source_facts_revision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f"}},"ManualEvidence":{"manual_path":"/docs/18/auth-trust.html","release":{"catalog_fingerprint":"65c93d6048ef30e61023a84f9680fa6a92b1c383b7eb226741170077eb078502","channel":"stable","label":"18.6","major":"18","ref":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2","revision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","source_sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f"},"sources":[{"label":"Matching PostgreSQL source archive","sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","url":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2"},{"label":"PostgreSQL 18 English manual","path":"auth-trust.html","sha256":"e4c50d6f88b13feb2004634788c61e0f797ff2d5b1ab6bb86de30229cef38a87","url":"/docs/18/auth-trust.html"},{"label":"PostgreSQL 18 English manual","path":"auth-pg-hba-conf.html","sha256":"6340d4abea2e0a3482afc31bcd1599a0fa10dc28a6f1e05d79ba831e2dd0b4c9","url":"/docs/18/auth-pg-hba-conf.html"}]},"MeasuredEvidence":{}},"Text":{"Collection":"auth","Key":"trust","SourceDatabase":"center","Version":"18","Locale":"en","Title":"trust","Summary":"Allow the connection unconditionally. This method allows anyone that can connect to the PostgreSQL database server to login as any PostgreSQL user they wish, without the need for a password or any other authentication. See Section 20.4 for details.","BodyHTML":"\u003cdiv id=\"AUTH-TRUST\"\u003e\n\u003cdiv\u003e\n\u003cdiv\u003e\n\u003cdiv\u003e\n\u003ch2\u003e20.4. Trust Authentication \u003c/h2\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003cp\u003eWhen \u003ccode\u003etrust\u003c/code\u003e authentication is specified, \u003cspan\u003ePostgreSQL\u003c/span\u003e assumes that anyone who can connect to the server is authorized to access the database with whatever database user name they specify (even superuser names). Of course, restrictions made in the \u003ccode\u003edatabase\u003c/code\u003e and \u003ccode\u003euser\u003c/code\u003e columns still apply. This method should only be used when there is adequate operating-system-level protection on connections to the server.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003etrust\u003c/code\u003e authentication is appropriate and very convenient for local connections on a single-user workstation. It is usually \u003cspan\u003e\u003cem\u003enot\u003c/em\u003e\u003c/span\u003e appropriate by itself on a multiuser machine. However, you might be able to use \u003ccode\u003etrust\u003c/code\u003e even on a multiuser machine, if you restrict access to the server\u0026#39;s Unix-domain socket file using file-system permissions. To do this, set the \u003ccode\u003eunix_socket_permissions\u003c/code\u003e (and possibly \u003ccode\u003eunix_socket_group\u003c/code\u003e) configuration parameters as described in \u003ca href=\"/docs/18/runtime-config-connection.html\" rel=\"nofollow\"\u003eSection 19.3\u003c/a\u003e. Or you could set the \u003ccode\u003eunix_socket_directories\u003c/code\u003e configuration parameter to place the socket file in a suitably restricted directory.\u003c/p\u003e\n\u003cp\u003eSetting file-system permissions only helps for Unix-socket connections. Local TCP/IP connections are not restricted by file-system permissions. Therefore, if you want to use file-system permissions for local security, remove the \u003ccode\u003ehost ... 127.0.0.1 ...\u003c/code\u003e line from \u003ccode\u003epg_hba.conf\u003c/code\u003e, or change it to a non-\u003ccode\u003etrust\u003c/code\u003e authentication method.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003etrust\u003c/code\u003e authentication is only suitable for TCP/IP connections if you trust every user on every machine that is allowed to connect to the server by the \u003ccode\u003epg_hba.conf\u003c/code\u003e lines that specify \u003ccode\u003etrust\u003c/code\u003e. It is seldom reasonable to use \u003ccode\u003etrust\u003c/code\u003e for any TCP/IP connections other than those from \u003cspan\u003elocalhost\u003c/span\u003e (127.0.0.1).\u003c/p\u003e\n\u003c/div\u003e","SourceRevision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","ContentHash":"a6b10f399fac087675e294a4a4d28f8f34f266b2271c2669c31a78fe7275f1d4","Payload":{"description":["Allow the connection unconditionally. This method allows anyone that can connect to the PostgreSQL database server to login as any PostgreSQL user they wish, without the need for a password or any other authentication. See Section 20.4 for details."],"manual_html":"\u003cdiv class=\"sect1\" id=\"AUTH-TRUST\"\u003e\n\u003cdiv class=\"titlepage\"\u003e\n\u003cdiv\u003e\n\u003cdiv\u003e\n\u003ch2 class=\"title\"\u003e20.4. Trust Authentication \u003c/h2\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003cp\u003eWhen \u003ccode class=\"literal\"\u003etrust\u003c/code\u003e authentication is specified, \u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e assumes that anyone who can connect to the server is authorized to access the database with whatever database user name they specify (even superuser names). Of course, restrictions made in the \u003ccode class=\"literal\"\u003edatabase\u003c/code\u003e and \u003ccode class=\"literal\"\u003euser\u003c/code\u003e columns still apply. This method should only be used when there is adequate operating-system-level protection on connections to the server.\u003c/p\u003e\n\u003cp\u003e\u003ccode class=\"literal\"\u003etrust\u003c/code\u003e authentication is appropriate and very convenient for local connections on a single-user workstation. It is usually \u003cspan class=\"emphasis\"\u003e\u003cem\u003enot\u003c/em\u003e\u003c/span\u003e appropriate by itself on a multiuser machine. However, you might be able to use \u003ccode class=\"literal\"\u003etrust\u003c/code\u003e even on a multiuser machine, if you restrict access to the server's Unix-domain socket file using file-system permissions. To do this, set the \u003ccode class=\"varname\"\u003eunix_socket_permissions\u003c/code\u003e (and possibly \u003ccode class=\"varname\"\u003eunix_socket_group\u003c/code\u003e) configuration parameters as described in \u003ca class=\"xref\" href=\"/docs/18/runtime-config-connection.html\" title=\"19.3. Connections and Authentication\"\u003eSection 19.3\u003c/a\u003e. Or you could set the \u003ccode class=\"varname\"\u003eunix_socket_directories\u003c/code\u003e configuration parameter to place the socket file in a suitably restricted directory.\u003c/p\u003e\n\u003cp\u003eSetting file-system permissions only helps for Unix-socket connections. Local TCP/IP connections are not restricted by file-system permissions. Therefore, if you want to use file-system permissions for local security, remove the \u003ccode class=\"literal\"\u003ehost ... 127.0.0.1 ...\u003c/code\u003e line from \u003ccode class=\"filename\"\u003epg_hba.conf\u003c/code\u003e, or change it to a non-\u003ccode class=\"literal\"\u003etrust\u003c/code\u003e authentication method.\u003c/p\u003e\n\u003cp\u003e\u003ccode class=\"literal\"\u003etrust\u003c/code\u003e authentication is only suitable for TCP/IP connections if you trust every user on every machine that is allowed to connect to the server by the \u003ccode class=\"filename\"\u003epg_hba.conf\u003c/code\u003e lines that specify \u003ccode class=\"literal\"\u003etrust\u003c/code\u003e. It is seldom reasonable to use \u003ccode class=\"literal\"\u003etrust\u003c/code\u003e for any TCP/IP connections other than those from \u003cspan class=\"systemitem\"\u003elocalhost\u003c/span\u003e (127.0.0.1).\u003c/p\u003e\n\u003c/div\u003e","related":[],"sections":[],"tables":[]}},"RequestedLocale":"en","Fallback":false,"Versions":["10","11","12","13","14","15","16","17","18","19","20"],"Locales":["en","zh-Hans"],"Signatures":null,"Spellings":null,"SQLState":null,"Evidence":null}