From: Bruce Momjian <bruce@momjian.us>
To: Benedict Holland <benedict.m.holland@gmail.com>
Cc: David G. Johnston <david.g.johnston@gmail.com>
Cc: bejita0409@yahoo.co.jp <bejita0409@yahoo.co.jp>
Cc: pgsql-admin@lists.postgresql.org <pgsql-admin@lists.postgresql.org>
Cc: pgsql-general@lists.postgresql.org <pgsql-general@lists.postgresql.org>
Subject: Re: How to revoke privileged from PostgreSQL's superuser
Date: Tue, 14 Aug 2018 15:59:19 -0400
Message-ID: <20180814195919.GA29140@momjian.us> (raw)
In-Reply-To: <CAD+mzow89NrETPt57G21BN9cdf90uHYGnCiC_8wR8REoudnt5g@mail.gmail.com>
References: <913907.28546.qm@web103014.mail.kks.yahoo.co.jp>
<CAKFQuwa0SyyzaKEtQzBc008HvtR7GVzv4Nd75Qe_OXtAqzgGGA@mail.gmail.com>
<20180810194105.GD7840@momjian.us>
<CAD+mzow89NrETPt57G21BN9cdf90uHYGnCiC_8wR8REoudnt5g@mail.gmail.com>
On Fri, Aug 10, 2018 at 04:06:40PM -0400, Benedict Holland wrote:
> I also would take Bruce's comment with a massive grain of salt. Everything that
> everyone does on a database is logged somewhere assuming proper logging. Now do
> you have the person-power to go through gigs of plain text logs to find out if
> someone is doing something shady... that is a question for your management
> team. Also, if you suspect someone of doing something shady, you should
> probably revoke their admin rights.
Agreed, the best way to limit the risk of undetected DBA removal of data
is secure auditing --- I should have mentioned that.
--
Bruce Momjian <bruce@momjian.us> http://momjian.us
EnterpriseDB http://enterprisedb.com
+ As you are, so once was I. As I am, so you will be. +
+ Ancient Roman grave inscription +
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: bruce@momjian.us, benedict.m.holland@gmail.com, david.g.johnston@gmail.com, bejita0409@yahoo.co.jp, pgsql-admin@lists.postgresql.org, pgsql-general@lists.postgresql.org
Subject: Re: How to revoke privileged from PostgreSQL's superuser
In-Reply-To: <20180814195919.GA29140@momjian.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox