Re: [External] How to revoke privileged from PostgreSQL's superuser

Поиск
Список
Период
Сортировка
Искать
От
Vijaykumar Jain
Тема
Re: [External] How to revoke privileged from PostgreSQL's superuser
Дата
Msg-id
932A7324-FC28-4F5F-8CD2-C772B5B891C0@opentable.com
Ответ на
Список
Дерево обсуждения
How to revoke privileged from PostgreSQL's superuser bejita0409@yahoo.co.jp
RE: How to revoke privileged from PostgreSQL's superuser "Charles Clavadetscher" <clavadetscher@swisspug.org>
Re: How to revoke privileged from PostgreSQL's superuser Tim Cross <theophilusx@gmail.com>
Re: [External] How to revoke privileged from PostgreSQL's superuser Vijaykumar Jain <vjain@opentable.com>
Re: How to revoke privileged from PostgreSQL's superuser "David G. Johnston" <david.g.johnston@gmail.com>
Re: How to revoke privileged from PostgreSQL's superuser Bruce Momjian <bruce@momjian.us>
Re: How to revoke privileged from PostgreSQL's superuser Benedict Holland <benedict.m.holland@gmail.com>
Re: How to revoke privileged from PostgreSQL's superuser Bruce Momjian <bruce@momjian.us>
Re: How to revoke privileged from PostgreSQL's superuser dangal <danielito.gallo@gmail.com>
Re: How to revoke privileged from PostgreSQL's superuser Evan Bauer <evanbauer@mac.com>
Re: How to revoke privileged from PostgreSQL's superuser dangal <danielito.gallo@gmail.com>
Re: How to revoke privileged from PostgreSQL's superuser Evan Rempel <erempel@uvic.ca>
Re: How to revoke privileged from PostgreSQL's superuser Tim Cross <theophilusx@gmail.com>
Re: How to revoke privileged from PostgreSQL's superuser Bruce Momjian <bruce@momjian.us>
Re: How to revoke privileged from PostgreSQL's superuser Evan Rempel <erempel@uvic.ca>
Re: How to revoke privileged from PostgreSQL's superuser Bruce Momjian <bruce@momjian.us>
Re: How to revoke privileged from PostgreSQL's superuser Evan Rempel <erempel@uvic.ca>
Re: How to revoke privileged from PostgreSQL's superuser Bruce Momjian <bruce@momjian.us>
Re: How to revoke privileged from PostgreSQL's superuser Evan Rempel <erempel@uvic.ca>
Re: How to revoke privileged from PostgreSQL's superuser Bruce Momjian <bruce@momjian.us>
Re: How to revoke privileged from PostgreSQL's superuser Scott Ribe <scott_ribe@elevated-dev.com>
Re: How to revoke privileged from PostgreSQL's superuser Bruce Momjian <bruce@momjian.us>
Re: How to revoke privileged from PostgreSQL's superuser Scott Ribe <scott_ribe@elevated-dev.com>
Re: How to revoke privileged from PostgreSQL's superuser Tim Cross <theophilusx@gmail.com>
Re: How to revoke privileged from PostgreSQL's superuser Evan Bauer <evanbauer@mac.com>
Re: How to revoke privileged from PostgreSQL's superuser "David G. Johnston" <david.g.johnston@gmail.com>
Re: How to revoke privileged from PostgreSQL's superuser raf <raf@raf.org>
Re: How to revoke privileged from PostgreSQL's superuser Bruce Momjian <bruce@momjian.us>
Re: How to revoke privileged from PostgreSQL's superuser Bear Giles <bgiles@coyotesong.com>
Re: How to revoke privileged from PostgreSQL's superuser Bear Giles <bgiles@coyotesong.com>
Re: How to revoke privileged from PostgreSQL's superuser Tom Lane <tgl@sss.pgh.pa.us>
Re: How to revoke privileged from PostgreSQL's superuser Bear Giles <bgiles@coyotesong.com>
Re: How to revoke privileged from PostgreSQL's superuser Evan Bauer <evanbauer@mac.com>
Re: Re: How to revoke privileged from PostgreSQL's superuser bejita0409@yahoo.co.jp
Re: Re: How to revoke privileged from PostgreSQL's superuser Bear Giles <bgiles@coyotesong.com>
Re: How to revoke privileged from PostgreSQL's superuser Bear Giles <bgiles@coyotesong.com>
Re: How to revoke privileged from PostgreSQL's superuser Rui DeSousa <rui@crazybean.net>
Re: How to revoke privileged from PostgreSQL's superuser Benedict Holland <benedict.m.holland@gmail.com>
Re: How to revoke privileged from PostgreSQL's superuser Rui DeSousa <rui@crazybean.net>
Re: How to revoke privileged from PostgreSQL's superuser Bruce Momjian <bruce@momjian.us>

I am not sure superuser can be selectively restricted via queries, but I am not sure, have not tried.

 

But maybe you can try restricting the super user access to the db from all hosts via the pg_hba.conf.

 

Fore eg. I have a user

monitor            | Superuser

 

and

in my /etc/postgresql/10/main/pg_hba.conf

 

host pgtesting monitor 0.0.0.0/0       reject

 

and then

psql -U monitor -p 5432 -d pgtesting -h 127.0.0.1

psql: FATAL:  pg_hba.conf rejects connection for host "127.0.0.1", user "monitor", database "pgtesting", SSL on

FATAL:  pg_hba.conf rejects connection for host "127.0.0.1", user "monitor", database "pgtesting", SSL off

 

psql -U monitor -p 5432 -d pgtesting -h localhost

psql: FATAL:  pg_hba.conf rejects connection for host "127.0.0.1", user "monitor", database "pgtesting", SSL on

FATAL:  pg_hba.conf rejects connection for host "127.0.0.1", user "monitor", database "pgtesting", SSL off

 

psql -U monitor -p 5432 -d pgtesting -h 173.16.6.3

psql: FATAL:  pg_hba.conf rejects connection for host "173.16.6.3", user "monitor", database "pgtesting", SSL on

FATAL:  pg_hba.conf rejects connection for host "173.16.6.3", user "monitor", database "pgtesting", SSL off

 

 

https://stackoverflow.com/questions/38942868/revoke-superuser-connect-a-specific-database

 

Thanks,

Vijay

 

 

From: "bejita0409@yahoo.co.jp" <bejita0409@yahoo.co.jp>
Reply-To: "bejita0409@yahoo.co.jp" <bejita0409@yahoo.co.jp>
Date: Monday, August 6, 2018 at 3:19 PM
To: "pgsql-admin@lists.postgresql.org" <pgsql-admin@lists.postgresql.org>, "pgsql-general@lists.postgresql.org" <pgsql-general@lists.postgresql.org>
Subject: [External] How to revoke privileged from PostgreSQL's superuser

 

 

I am a newbie DBA.

 

I have a request for revoking the access to user's data from DBA-user.

I think the request is right because users should be the only ones can access their data.

But DBA-user also need full access to the other data? It means that DBA-user also needs to be a superuser.

 

So I conclude the request that how to revoke privileged from superuser in postgres.

 

As my knowledge, the superuser in PostgreSQL bypasses all the permission check.

So that, there is no way to do it in PostgreSQL, is that right?

 

Is there some DBAs are faced with this before?

 

 

Thanks,

--

bejita

В списке pgsql-admin по дате отправления
От: bejita0409@yahoo.co.jp
Дата:
От: Jehan-Guillaume (ioguix) de Rorthais
Дата:
Сообщение: Re: PostgreSQL 11 global index
FAQ