I realize this is question is years old, but I ran into this same problem today and have a solution that uses trust
in a limited but useful way.
As in many development shops, when the devs need a QA postgres password, they just yell it, message it, email it, write it on their foreheads, etc. And I'm like, "This is really bad. I need to figure out a way to use PKI here." We also use pgAdmin3.
First, add a line like this to your pg_hba.conf, where dev
represents the user for the developers in your shop:
host all dev 127.0.0.1/32 trust
Drop the developers' public key in their authorized_keys
folder on the database server. Now have them ssh into the server with the -L
flag with a command similar to the following:
ssh -i ~/.ssh/id_rsa -L5432:127.0.0.1:5432 -vvv 101.102.103.104
This allows one to use the postgres port as if it were localhost. Of course, replace the key, server and make sure to map to an open port locally (if you have a local postgres running, it's probably bound to 5432). I use a pretty verbose flag so I can easily troubleshoot any ssh issues.
Open another terminal and issue this command:
psql -h 127.0.0.1 -U dev -p 5432
You should have access to the database and never be prompted for a password, which I think is great because otherwise, the devs will just waive the password around with little regard to security, passing it out like Halloween candy.
As of now, PgAdmin3 will still prompt you for a password, even though -- plain as day -- you do not need it. But other postgres GUIs will not. Try Postico. It's in beta but works great.
I hope this answer helps anyone like me who would rather use PKI for postgres auth rather than sharing passwords willy-nilly.