From: Kevin Grittner <Kevin.Grittner@wicourts.gov>
To: Khangelani Gama <kgama@argility.com>
To: pgsql-admin@postgresql.org
Subject: Re: Update actions (with user name) inside PostgreSQL DB - any version on postgreSQL
Date: Wed, 14 Mar 2012 09:02:48 -0500
Message-ID: <4F605EB80200002500046293@gw.wicourts.gov> (raw)
In-Reply-To: <98bfa47ff4bb6e222e89f751bbcbf4a7@mail.gmail.com>
References: <8ecc4155e8754edef35e260a60a4a8db@mail.gmail.com>
<1331722455.5503.166.camel@elliot>
<98bfa47ff4bb6e222e89f751bbcbf4a7@mail.gmail.com>
Khangelani Gama <kgama@argility.com> wrote:
> the issue we have is that we have many Linux users having root
> access into the system.
Which gives them rights to impersonate any other user on the system
and to erase any audit trail written on that system.
> Auditors wants PostgreSQL to tell who updated what inside the
> database
You might be able to create something which looks plausible without
solving the first problem, but it wouldn't be at all trustworthy.
Consider limiting access to root on your database servers and, in
general, pay attention to the concept of "separation of duties"[1].
-Kevin
[1] http://en.wikipedia.org/wiki/Separation_of_duties
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: Kevin.Grittner@wicourts.gov, kgama@argility.com
Subject: Re: Update actions (with user name) inside PostgreSQL DB - any version on postgreSQL
In-Reply-To: <4F605EB80200002500046293@gw.wicourts.gov>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox