pg.ddx.io  pgsql-admin@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Craig James <craig_james@emolecules.com>
To: pgsql-admin@postgresql.org
Subject: Re: Securing a remotely accessible PostgreSQL server
Date: Wed, 22 Dec 2010 16:05:56 -0800
Message-ID: <4D129264.2010701@emolecules.com> (raw)
In-Reply-To: <AANLkTimGJ9fLSfEhNu26eoMjj+7_p94d2s0XOO-Lm2Yd@mail.gmail.com>
References: <4D122D10.7090805@saucetel.com>
	<4D1227A30200002500038A0C@gw.wicourts.gov>
	<AANLkTimGJ9fLSfEhNu26eoMjj+7_p94d2s0XOO-Lm2Yd@mail.gmail.com>

> Josh<josh@saucetel.com>  wrote:
>
> I am looking for suggestions on how best to secure a server that
> is accessible via the internet. Even account creation for the
> database is open to the world. Does anybody have any extra changes
> they would make to postgresql.conf or OS changes they would
> suggest? Perhaps some default permissions that would be best
> revoked?
>
> The system setup is currently a Linux box running PostgreSQL 8.4
> My pg_hba.conf already limits remote connections to one database
> and one particular role.

You don't give any details about your users or how/why they need this access so it's hard to give good advice.  But one possibility is to use SSH tunneling, so that your users have to log in to your server first using a protocol that's pretty secure.

    ssh -L5432:localhost:5432 user@host.com

Then the user connects locally instead of directly.  On the user's computer:

    psql -h localhost dbname

We've used this technique when a developer had to work from a remote location.  There is no direct access to Postgres at all, yet you can work remotely and securely.

Craig



view thread (4+ messages)

Message-ID: <4D129264.2010701@emolecules.com>
Permalink:  ../4D129264.2010701@emolecules.com/
Also on:    postgresql.org/message-id/4D129264.2010701@emolecules.com

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-admin@postgresql.org
  Cc: craig_james@emolecules.com
  Subject: Re: Securing a remotely accessible PostgreSQL server
  In-Reply-To: <4D129264.2010701@emolecules.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox