Обсуждение: Security Problem

Hi to all

I'm mantaining a Postgres installation on an ISP, and I see a relativly
important security issue.

I can connect to postgres with a normal user login and take a look to
the database structure of all the other databases on the installation.

This is very visual with PGadmin. I connect as a simple user, and I
can't create or select data from other's database, but i can see which
databases exists on the system and look at the tables and columns of
each of them (and i don't want it).

I've tried to solve it with:

REVOKE ALL PRIVILEGES ON DATABASE x FROM PUBLIC;
REVOKE ALL PRIVILEGES ON SCHEMA public FROM PUBLIC;
REVOKE ALL PRIVILEGES ON SCHEMA public FROM GROUP users;
...

And I still can to look at the others database structure (connecting as
a non privileged user) ...

How I could solve this?

Thanks
--
********************************************************
Daniel Rubio Rodríguez
********************************************************

On Tue, 14 Oct 2003, Daniel Rubio wrote:

> And I still can to look at the others database structure (connecting as
> a non privileged user) ...
>

Did you try setting search_path in postgresql.conf to just '$user'?

You'll also need a schema for each user.
perhaps db_user_namespace does this? I didn't find much info on that.


--
Jeff Trout <jeff@jefftrout.com>
http://www.jefftrout.com/
http://www.stuarthamm.net/

Daniel Rubio <drubior@tinet.org> writes:
> I'm mantaining a Postgres installation on an ISP, and I see a relativly
> important security issue.
> I can connect to postgres with a normal user login and take a look to
> the database structure of all the other databases on the installation.

That is correct; we do not consider it a security problem.  If you don't
want a user to be able to look at the system catalogs of a database, you
need to disallow him from connecting to that database at all.  (See
pg_hba.conf for this, not GRANT/REVOKE.)

            regards, tom lane

On Tue, Oct 14, 2003 at 11:32:03AM +0200, Daniel Rubio wrote:
> How I could solve this?

Upgrade to 7.3 and use the schema support to do it for you.

A

--
----
Andrew Sullivan                         204-4141 Yonge Street
Afilias Canada                        Toronto, Ontario Canada
<andrew@libertyrms.info>                              M2P 2A8
                                         +1 416 646 3304 x110