From: Tom Lane <tgl@sss.pgh.pa.us>
To: Bear Giles <bgiles@coyotesong.com>
Cc: bejita0409@yahoo.co.jp, "pgsql-admin@lists.postgresql.org" <pgsql-admin@lists.postgresql.org>
Cc: pgsql-general@lists.postgresql.org <pgsql-general@lists.postgresql.org>
Subject: Re: How to revoke privileged from PostgreSQL's superuser
Date: Mon, 06 Aug 2018 09:43:06 -0400
Message-ID: <26930.1533562986@sss.pgh.pa.us> (raw)
In-Reply-To: <CALBNtw4NEWUvkPsUCDmOtpt391V_X+DpRGoTf76KMG16EkAPKQ@mail.gmail.com>
References: <913907.28546.qm@web103014.mail.kks.yahoo.co.jp>
<CALBNtw4NEWUvkPsUCDmOtpt391V_X+DpRGoTf76KMG16EkAPKQ@mail.gmail.com>
Bear Giles <bgiles@coyotesong.com> writes:
> In postgresql the equivalent user is 'postgres'. Nobody should ever be
> logged in as that user once you've created the initial user(s). What
> postgresql calls a 'superuser' is just a user with a few permissions set by
> default. It's easy to grant the same privileges to any user, or drop them
> from someone created as a superuser.
Well, more to the point, a superuser is somebody with the rolsuper bit
set in their pg_authid entry. You can revoke the bootstrap superuser's
superuserness if you have a mind to -- see ALTER USER. However, as
everyone has pointed out already, this is a bad idea and you will end
up undoing it. (Figuring out how to do that without a reinstall is left
as penance for insisting on a bad idea. It is possible, and I think
even documented.)
However: a whole lot of what the bootstrap superuser can do is inherent
in being the owner of all the built-in database objects, and that you
cannot get rid of. Objects have to be owned by somebody.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: tgl@sss.pgh.pa.us, bgiles@coyotesong.com, pgsql-admin@lists.postgresql.org, pgsql-general@lists.postgresql.org
Subject: Re: How to revoke privileged from PostgreSQL's superuser
In-Reply-To: <26930.1533562986@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox