From: Stephen Frost <sfrost@snowman.net>
To: Daniel Gomez Blanco <nanodgb@gmail.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: pgsql-admin@postgresql.org
Subject: Re: Pros and cons of giving someone superuser privilege
Date: Fri, 25 Apr 2014 10:52:24 -0400
Message-ID: <20140425145224.GN2556@tamriel.snowman.net> (raw)
In-Reply-To: <CAL4HELdYD7AvLfgVwvwdV3R_GW_xcVz95EE5cNisvwZgYfxV_w@mail.gmail.com>
References: <CAL4HELd-Zhk3exeNdk=dxwVsAwXrgnTRfbsCThH3T0=KA33A_w@mail.gmail.com>
<5924.1398434535@sss.pgh.pa.us>
<CAL4HELdYD7AvLfgVwvwdV3R_GW_xcVz95EE5cNisvwZgYfxV_w@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-admin>
* Daniel Gomez Blanco (nanodgb@gmail.com) wrote:
> >From your reply and considering why I have just said, I think that, in our
> case, these users would be better off without superuser access. As for
> their day-to-day operations they wouldn't need it as long as they can
> create their databases and roles, and execute the rest of operations on the
> web interface.
Just to hit on this again- that means your users can't install any
extensions (not even those provided as part of PG through contrib).
Eventually, users will get upset by the lack of things like PostGIS.
They also can't create stored procedures using any of the untrusted
languages (of course, if they could, they could get access to the host,
so that may be a show-stopper anyway).
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 835B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: sfrost@snowman.net, nanodgb@gmail.com, tgl@sss.pgh.pa.us
Subject: Re: Pros and cons of giving someone superuser privilege
In-Reply-To: <20140425145224.GN2556@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox