pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedpgadmin user access control features
3+ messages / 3 participants
[nested] [flat]
* pgadmin user access control features
@ 2011-01-04 17:04 Dan Sabin <dan.sabin@nextwavesys.com>
0 siblings, 1 reply; 3+ messages in thread
From: Dan Sabin @ 2011-01-04 17:04 UTC (permalink / raw)
To: pgsql-admin
Hello,
So I plan on deploying a Postgres DB in an military project. On our admin end we are using the tool to help set up the database for delivery. Now the problem comes once the system is delivered. The database is used to record all the system messages for easy retrieval. This feature is rarely used and is only there if the system accidentally kills someone (Military grade security system with guns), the client needs to be able to reconstruct the event.
In order to do this the client needs an interface to access the database. The two options are to give them a query tool we design so we can restrict their actions (to prevent the database from being screwed up). The other option would be to restrict their access in the pgadmin tool installed on the system itself and prevent them from deleting data. Is it possible to set up accounts within the tool and secure the admin access for ourselves so they can only run certain types of queries on their own account.
I know this is possible with MS SQL Server tools, but we're bound to open source solutions. Any information would be useful.
Thank you,
Dan
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: pgadmin user access control features
@ 2011-01-04 18:04 Kevin Grittner <Kevin.Grittner@wicourts.gov>
0 siblings, 0 replies; 3+ messages in thread
From: Kevin Grittner @ 2011-01-04 18:04 UTC (permalink / raw)
To: dan.sabin@nextwavesys.com; pgsql-admin
Dan Sabin wrote:
> In order to do this the client needs an interface to access the
> database. The two options are to give them a query tool we design
> so we can restrict their actions (to prevent the database from
> being screwed up). The other option would be to restrict their
> access in the pgadmin tool installed on the system itself and
> prevent them from deleting data. Is it possible to set up accounts
> within the tool and secure the admin access for ourselves so they
> can only run certain types of queries on their own account.
I'm not sure I fully understand, but take a look at these:
http://www.postgresql.org/docs/9.0/interactive/sql-createuser.html
http://www.postgresql.org/docs/9.0/interactive/sql-grant.html
http://www.postgresql.org/docs/9.0/interactive/sql-revoke.html
http://www.postgresql.org/docs/9.0/interactive/client-authentication.html
If these don't provide the information you need, please post again
with a little more information about what you're trying to
accomplish.
-Kevin
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: pgadmin user access control features
@ 2011-01-04 19:39 Mark Felder <feld@feld.me>
parent: Dan Sabin <dan.sabin@nextwavesys.com>
0 siblings, 0 replies; 3+ messages in thread
From: Mark Felder @ 2011-01-04 19:39 UTC (permalink / raw)
To: pgsql-admin
On Tue, 04 Jan 2011 11:04:56 -0600, Dan Sabin <dan.sabin@nextwavesys.com>
wrote:
> The two options are to give them a query tool we design so we can
> restrict their actions (to prevent the database from being screwed up).
If their user still has access to doing other things it might be possible
for that data to be modified using regular postgres tools, which is a a
security risk of sorts. Perhaps it might be best for you to setup certain
functions or stored procedures that their database user only has access
to? I assume this is possible, anyway.
Regards,
Mark
^ permalink raw reply [nested|flat] 3+ messages in thread
end of thread, other threads:[~2011-01-04 19:39 UTC | newest]
Thread overview: 3+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2011-01-04 17:04 pgadmin user access control features Dan Sabin <dan.sabin@nextwavesys.com>
2011-01-04 19:39 ` Mark Felder <feld@feld.me>
2011-01-04 18:04 Re: pgadmin user access control features Kevin Grittner <Kevin.Grittner@wicourts.gov>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox