From: Bruce Momjian <bruce@momjian.us>
To: Evan Rempel <erempel@uvic.ca>
Cc: pgsql-admin@lists.postgresql.org
Subject: Re: How to revoke privileged from PostgreSQL's superuser
Date: Wed, 15 Aug 2018 15:28:38 -0400
Message-ID: <20180815192838.GA5005@momjian.us> (raw)
In-Reply-To: <10cde505-db4b-bbeb-7d8a-7c4e145c6042@uvic.ca>
References: <913907.28546.qm@web103014.mail.kks.yahoo.co.jp>
<CAKFQuwa0SyyzaKEtQzBc008HvtR7GVzv4Nd75Qe_OXtAqzgGGA@mail.gmail.com>
<20180810194105.GD7840@momjian.us>
<CAD+mzow89NrETPt57G21BN9cdf90uHYGnCiC_8wR8REoudnt5g@mail.gmail.com>
<20180814195919.GA29140@momjian.us>
<20180815145912.GA11573@momjian.us>
<10cde505-db4b-bbeb-7d8a-7c4e145c6042@uvic.ca>
On Wed, Aug 15, 2018 at 09:05:51AM -0700, Evan Rempel wrote:
> At the end of the day someone has full access and control and can do anything without auditing database statements.
>
> For instance, as the root user on the server, I can do:
>
> - shutdown the server database
> - copy the entire DB filespace to my workstation
> - change the workstation config for no logging/auditing
> - start the workstation Database
> - make all the changes I want at the workstation.
> - stop the workstation database
> - copy all of the files back to the server
> - start the server Database.
>
> no logging of any kind and all of the data would be suspect.
Well, that is an intersting attack, and I don't think it requires root
--- all it requires is access to the Postgres data directory. Frankly,
I don't know if there is a way to prevent the Postgres superuser from
silently disabling logging because the _data_ is fully under the control
of the Postgres superuser.
--
Bruce Momjian <bruce@momjian.us> http://momjian.us
EnterpriseDB http://enterprisedb.com
+ As you are, so once was I. As I am, so you will be. +
+ Ancient Roman grave inscription +
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: bruce@momjian.us, erempel@uvic.ca, pgsql-admin@lists.postgresql.org
Subject: Re: How to revoke privileged from PostgreSQL's superuser
In-Reply-To: <20180815192838.GA5005@momjian.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox