Received: from magus.postgresql.org (magus.postgresql.org [87.238.57.229]) by mail.postgresql.org (Postfix) with ESMTP id 63D361B505EF for ; Wed, 14 Mar 2012 11:03:11 -0300 (ADT) Received: from gwmta.wicourts.gov ([165.219.244.99] helo=gw.wicourts.gov) by magus.postgresql.org with esmtp (Exim 4.72) (envelope-from ) id 1S7onD-0000W5-VK for pgsql-admin@postgresql.org; Wed, 14 Mar 2012 14:03:10 +0000 Received: from Courts-MTA by gw.wicourts.gov with Novell_GroupWise; Wed, 14 Mar 2012 09:02:53 -0500 Message-Id: <4F605EB80200002500046293@gw.wicourts.gov> X-Mailer: Novell GroupWise Internet Agent 8.0.2 Date: Wed, 14 Mar 2012 09:02:48 -0500 From: "Kevin Grittner" To: "Khangelani Gama" , Subject: Re: Update actions (with user name) inside PostgreSQL DB - any version on postgreSQL References: <8ecc4155e8754edef35e260a60a4a8db@mail.gmail.com> <1331722455.5503.166.camel@elliot> <98bfa47ff4bb6e222e89f751bbcbf4a7@mail.gmail.com> In-Reply-To: <98bfa47ff4bb6e222e89f751bbcbf4a7@mail.gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Content-Disposition: inline X-Pg-Spam-Score: -4.2 (----) X-Archive-Number: 201203/82 X-Sequence-Number: 39270 Khangelani Gama wrote: > the issue we have is that we have many Linux users having root > access into the system. Which gives them rights to impersonate any other user on the system and to erase any audit trail written on that system. > Auditors wants PostgreSQL to tell who updated what inside the > database You might be able to create something which looks plausible without solving the first problem, but it wouldn't be at all trustworthy. Consider limiting access to root on your database servers and, in general, pay attention to the concept of "separation of duties"[1]. -Kevin [1] http://en.wikipedia.org/wiki/Separation_of_duties