From: Tom Lane <tgl@sss.pgh.pa.us>
To: Maria.L.Wilson-1@nasa.gov
Cc: Plugge, Joe R. <JRPlugge@west.com>
Cc: Wilson, Maria Louise (LARC-E301)[SCIENCE SYSTEMS APPLICATIONS] <m.l.wilson@nasa.gov>
Cc: pgsql-admin@postgresql.org <pgsql-admin@postgresql.org>
Subject: Re: postgres database user account
Date: Wed, 30 Jun 2010 16:38:12 -0400
Message-ID: <16820.1277930292@sss.pgh.pa.us> (raw)
In-Reply-To: <4C2BA5F0.1020908@nasa.gov>
References: <4C2B97BE.7040405@nasa.gov>
<BD69807DAE0CE44CA00A8338D0FDD08302E49509A9@oma00cexmbx03.corp.westworlds.com>
<4C2BA2DF.2090900@nasa.gov>
<BD69807DAE0CE44CA00A8338D0FDD08302E49509B7@oma00cexmbx03.corp.westworlds.com>
<4C2BA5F0.1020908@nasa.gov>
"Maria L. Wilson" <Maria.L.Wilson-1@nasa.gov> writes:
> that sounds similar to what we are trying to accomplish. Looks like
> what we need to do is use the sudo at the OS level - and remove the
> postgres db user account altogether.... giving specific users the privs
> (or create roles) that accomplish what they need.
You can't remove the postgres DB account; it owns the core system
catalogs, functions, etc. In any case, understand that any superuser
database account is as powerful as any other. Giving DBAs superuser
accounts other than postgres is probably good just from an
administrative standpoint, but it won't reduce their capability to
screw things up.
If you're using a PG version recent enough to have a "createrole"
account attribute as distinct from "superuser", look into how much of
your admin work can be done with "createrole" accounts. Those are
a lot weaker than full superuser, but still are enough for many ordinary
admin tasks (such as managing everyday-user accounts).
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: tgl@sss.pgh.pa.us, Maria.L.Wilson-1@nasa.gov, JRPlugge@west.com, m.l.wilson@nasa.gov
Subject: Re: postgres database user account
In-Reply-To: <16820.1277930292@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox