Date: Wed, 15 Aug 2018 17:43:24 -0400
From: Bruce Momjian <bruce@momjian.us>
To: raf <raf@raf.org>
Cc: pgsql-admin@lists.postgresql.org
Subject: Re: How to revoke privileged from PostgreSQL's superuser
Message-ID: <20180815214324.GA23987@momjian.us>
References: <913907.28546.qm@web103014.mail.kks.yahoo.co.jp>
 <CAKFQuwa0SyyzaKEtQzBc008HvtR7GVzv4Nd75Qe_OXtAqzgGGA@mail.gmail.com>
 <20180810194105.GD7840@momjian.us>
 <CAD+mzow89NrETPt57G21BN9cdf90uHYGnCiC_8wR8REoudnt5g@mail.gmail.com>
 <20180814195919.GA29140@momjian.us>
 <20180815145912.GA11573@momjian.us>
 <20180815214111.xy4y7j5hg5jl7pgo@raf.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <20180815214111.xy4y7j5hg5jl7pgo@raf.org>
User-Agent: Mutt/1.5.23 (2014-03-12)
Precedence: bulk

On Thu, Aug 16, 2018 at 07:41:11AM +1000, raf wrote:
> Bruce Momjian wrote:
> 
> > On Tue, Aug 14, 2018 at 03:59:19PM -0400, Bruce Momjian wrote:
> > > On Fri, Aug 10, 2018 at 04:06:40PM -0400, Benedict Holland wrote:
> > > > I also would take Bruce's comment with a massive grain of salt. Everything that
> > > > everyone does on a database is logged somewhere assuming proper logging. Now do
> > > > you have the person-power to go through gigs of plain text logs to find out if
> > > > someone is doing something shady... that is a question for your management
> > > > team. Also, if you suspect someone of doing something shady, you should
> > > > probably revoke their admin rights. 
> > > 
> > > Agreed, the best way to limit the risk of undetected DBA removal of data
> > > is secure auditing --- I should have mentioned that.
> > 
> > So, how do you securely audit?  You ship the logs to a server that isn't
> > controlled by the DBA, via syslog?  How do you prevent the DBA from
> > turning off logging when the want to so something undetected?  Do you
> > log the turning off of logging?
> > 
> > -- 
> >   Bruce Momjian  <bruce@momjian.us>        http://momjian.us
> 
> Yes. You can set up terminal session logging with redhat's
> tlog (https://github.com/Scribery/tlog) which can record all
> terminal activity done via ssh, ship it offsite and replay it
> for auditing purposes. So if an administrator does turn off any
> logging (presumably including tlog itself), you'll at least be
> able to see them turning it off.

Ah, yes, I can see that as helpful.

-- 
  Bruce Momjian  <bruce@momjian.us>        http://momjian.us
  EnterpriseDB                             http://enterprisedb.com

+ As you are, so once was I.  As I am, so you will be. +
+                      Ancient Roman grave inscription +