Received: from localhost (unknown [200.46.204.183]) by postgresql.org (Postfix) with ESMTP id 3AB426503B5 for ; Mon, 18 Aug 2008 15:32:30 -0300 (ADT) Received: from postgresql.org ([200.46.204.86]) by localhost (mx1.hub.org [200.46.204.183]) (amavisd-maia, port 10024) with ESMTP id 36175-01-4 for ; Mon, 18 Aug 2008 15:32:22 -0300 (ADT) X-Greylist: from auto-whitelisted by SQLgrey-1.7.6 Received: from mailout02.ims-firmen.de (mailout02.ims-firmen.de [213.174.32.97]) by postgresql.org (Postfix) with ESMTP id 893DF650436 for ; Mon, 18 Aug 2008 15:24:34 -0300 (ADT) Received: from mailin02.ims-firmen.de ([192.168.1.111]) by mailout02.ims-firmen.de with esmtp (Exim 4.69) (envelope-from ) id 1KV9P4-0002f3-Tj; Mon, 18 Aug 2008 20:24:30 +0200 Received: from [213.174.32.254] (helo=localhost) by mailin02.ims-firmen.de with esmtpa (Exim 4.69) (envelope-from ) id 1KV9P4-0000sU-Sx; Mon, 18 Aug 2008 20:24:30 +0200 Date: Mon, 18 Aug 2008 20:24:30 +0200 From: Thomas Jacob To: Scott Marlowe Cc: Thomas Jacob , Robert Treat , pgsql-admin@postgresql.org Subject: Re: Best practice running a shared DB hosting server Message-ID: <20080818182430.GB22324@internet24.de> References: <1218635097.28547.28.camel@enterprise.ims-firmen.de> <1218642490.28547.50.camel@enterprise.ims-firmen.de> <200808181148.14557.xzilla@users.sourceforge.net> <1219077495.18884.38.camel@enterprise.ims-firmen.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.17+20080114 (2008-01-14) X-Virus-Scanned: Maia Mailguard 1.0.1 X-Spam-Status: No, hits=0 tagged_above=0 required=5 tests=none X-Spam-Level: X-Archive-Number: 200808/79 X-Sequence-Number: 29924 On Mon, Aug 18, 2008 at 10:49:49AM -0600, Scott Marlowe wrote: > On Mon, Aug 18, 2008 at 10:38 AM, Thomas Jacob wrote: > > I've changed my approach by revoking rights to schema public > > from PUBLIC in the template1, and then granting all rights > > to again just to the "main" user, and usage rights to > > the additional users. > > > > So people aren't forced to use schemas. > > Not sure exactly what you mean. Everything in pgsql lives in a > schema, whether it's public or another schema. By judicious use of > the search_path settings you can make the use of such schemas nearly > transparent to the users, but they're still there. Sorry, that was very vague. Some people might just be used to there being an explicit public schema. This is not very likely, agreed, but if having access to the public schema is not a security risk, then there is no need to force users to create additional schemas if they don't want to.