Received: from maia.hub.org (maia-5.hub.org [200.46.204.29])
	by mail.postgresql.org (Postfix) with ESMTP id 56A471337B80
	for <pgsql-admin-postgresql.org@mail.postgresql.org>;
	Wed, 22 Dec 2010 13:00:25 -0400 (AST)
Received: from mail.postgresql.org ([200.46.204.86])
	by maia.hub.org (mx1.hub.org [200.46.204.29]) (amavisd-maia, port 10024)
	with ESMTP id 10364-04 for
	<pgsql-admin-postgresql.org@mail.postgresql.org>;
	Wed, 22 Dec 2010 17:00:18 +0000 (UTC)
X-Greylist: delayed 00:06:39.52498 by SQLgrey-1.7.6
Received: from saucetel.com (saucetel.com [204.16.202.178])
	by mail.postgresql.org (Postfix) with ESMTP id DA6251337B9C
	for <pgsql-admin@postgresql.org>; Wed, 22 Dec 2010 13:00:17 -0400 (AST)
Received: (qmail 13745 invoked by uid 1345); 22 Dec 2010 11:53:37 -0500
Received: from trimarket.initechcomputers.com (HELO ?204.16.202.180?)
	(abstract@saucetel.com@204.16.202.180)
	by saucetel.com with SMTP; 22 Dec 2010 11:53:37 -0500
Message-ID: <4D122D10.7090805@saucetel.com>
Date: Wed, 22 Dec 2010 11:53:36 -0500
From: Josh <josh@saucetel.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US;
	rv:1.9.2.13) Gecko/20101207 Thunderbird/3.1.7
MIME-Version: 1.0
To: pgsql-admin@postgresql.org
Subject: Securing a remotely accessible PostgreSQL server
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: Maia Mailguard 1.0.1
X-Spam-Status: No, hits=-1.91 tagged_above=-10 required=5 tests=BAYES_00=-1.9,
	T_RP_MATCHES_RCVD=-0.01
X-Spam-Level: 
X-Archive-Number: 201012/168
X-Sequence-Number: 36397

Hi All,
I am looking for suggestions on how best to secure a server that is 
accessible via the internet. Even account creation for the database is 
open to the world. Does anybody have any extra changes they would make 
to postgresql.conf or OS changes they would suggest? Perhaps some 
default permissions that would be best revoked?

The system setup is currently a Linux box running PostgreSQL 8.4
My pg_hba.conf already limits remote connections to one database and one 
particular role.

I have been a bit hesitant to post this in the past as I believed many 
would just give the answer of "Don't". Please just humor me and give 
suggestions assuming it is the only way. Consider it a fun challenge.

Thanks for your help,
Josh