From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Devendra Yadav <devendra.857@gmail.com>
To: pgsql-admin@lists.postgresql.org
Subject: Re: Rename or Removing Postgres user
Date: Thu, 14 Feb 2019 13:30:32 +0100
Message-ID: <391a608c085a9b3ba28dcea6ff891c185df1cbcf.camel@cybertec.at> (raw)
In-Reply-To: <CAE+tJY9ozN5csfYz4+=nuw0ZHKPAojt=6bDVczXH4fYSx-wu2w@mail.gmail.com>
References: <CAE+tJY9ozN5csfYz4+=nuw0ZHKPAojt=6bDVczXH4fYSx-wu2w@mail.gmail.com>
Devendra Yadav wrote:
> I want to know if I rename 'postgres' user to 'someuser' retaining it's privileges i.e superuser and other privileges.
>
> Or what if I drop the 'postgres' user and create a new superuser. I tried dropping Postgres user but it says "cannot drop role postgres because it is required by the database system".
>
> So my concern is what happens if I rename it. As far as I can check there's no impact, but in case anyone has faced issues regarding this, please suggest.
You can rename the user without any problems.
Internally, only the object ID of the role is used,
the name is just an entry in "pg_authid".
Resources outside the database proper, for example
configuration files like "pg_hba.conf", will have to
be adapted.
You cannot drop the "postgres" user, however.
You say further downthread that you want to do this
for security reasons. Keep in mind that this is the lowest
form of security: "security by obscurity".
For better security, make sure that the superuser can
only log in from the database machine itself, and that
only administrators get shell access there.
Yours,
Laurenz Albe
--
Cybertec | https://www.cybertec-postgresql.com
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: laurenz.albe@cybertec.at, devendra.857@gmail.com, pgsql-admin@lists.postgresql.org
Subject: Re: Rename or Removing Postgres user
In-Reply-To: <391a608c085a9b3ba28dcea6ff891c185df1cbcf.camel@cybertec.at>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox